Fix TOTP token validation

* Removed support for number instances since they cannot represent all
  valid TOTP tokens.
* Fixed an issue where a valid TOTP token with a leading zero digit
  would be incorrectly considered as invalid.