Add ability to verify an OTP

https://www.pivotaltracker.com/story/show/78629110
Wouldn't this also cause the signature to be invalid? Same for the nonce check below