For 1.: I guess it would be better to think about it as setting otp *before* any auth request.
For 2. Nope.  requiring otp there would kind of defeat the purpose of having a session.