Update travis config to work around Composer issue

By default, Composer tries to install packages using the GitHub API.
This works fine until you hit the API limit, which happens very
frequently on Travis' infrastructure. The workaround is to use the
--prefer-source switch so Composer performs a source checkout instead of
an API download.
Better account for clock drift in TOTP::validate()

Since some devices may experience clock drift in both directions, and
because may not be possible to sync the time on those devices, we need
to account for bidirectional clock drift when validating TOTPs.

This commit introduces a change which shifts the window parameter to the
middle of the expected OTP range, so that a window of 4 will check two
counters before and after the current counter value. This deviates from
the original behavior of only checking $window counters after the
current.

Closes #1.