HOTP login for admins

Nice, love how the token type is totally abstracted away by the model.