OTP is validated first then the username and password are checked. Added a check to make sure the user owns the device when logging in via Share