make sure otp is always same length as @master_csrf_token