Anything more than 9 digits will be prepended with 0's. In fact, the RFC only explicitly mention 7-8 digits.

```
Implementations MUST extract a 6-digit code at a minimum and possibly
7 and 8-digit code.  Depending on security requirements, Digit = 7 or
more SHOULD be considered in order to extract a longer HOTP value.
```
I should raise a `ValueError` if length>9. Thoughts?