Allow null=ok so that one can have a mixture of OTP and non-OTP users