put qualifier in the right place, add test for setting qualifier in otpauth_user