on login, reset the OTP secret so codes can't be used more than once.