Rename HOTP to TOTP token validator

We're actually using a Time-based One-Time Password (TOTP) and not a
HMAC-based One-Time Password (HOTP).