OTP validator should require exact match