return otp flag at LoginPlugin.hello. client should send password without hash