Only check otp for client users