HOTP login for admins

Indeed, this is what's happening.  The changes in the template ensure that we use the correct OTP mode, and since we're just using `user.verify_token` in `admin_new_user_two_factor`, it works agnostic to what mode is used.