Support SOTP recovery keys.
Revoke used tokens atomically.

This should prevent replay attacks on TOTP and SOTP.
Add OTP packages to sample settings.