Otp is now required before disabling otp