update oathtool to use new API
indentation
list instead of 2 challenges, indentation