set otp_secret if given and confirmed