HOTP: API change

OATH.hotp_validate() now returns an integer instead of True. This allows
it to specify which position in the OTP window was the matching OTP.

Additionally, there were some clarifications in the docs.