validate passwd computed by totp hotp