Don't allow changing the OTP secret when OTP is already enabled

This fixes an OTP bypass where an attacker could request a new
OTP secret and use it to bypass two-factor auth for "/adminon".