TOO_LOW, not TO_LOW
check the request challenge on authenticate

fixes #6
clearer documentation about the counter field and errors

relates to #5