reject the YubiKey if the response was less than 12, not equal to 12

sometimes it's more (serial adds 4 bytes)