Reduce TOTP code max-age to 60 seconds

This PR reduces the allowed age of TOTP codes from 25 minutes to 1.  It extracts our TOTP verification code path to the util/totp module.