only attempt to parse otp from server on valid responses

it's not available otherwise