limit otp code to 4