Better handling of nil tokens (created from invalid URLs)
Remove MD5 support

(See http://mattrubin.me/2013/12/14/md5-otps.html for a thorough explanation)
Merge branch 'md5'