You need to add a `self.save!` after this (or maybe in the controller), as the OTP isn't getting saved on a rebuild.