Refactor SessionsController#validate_otp