HOTP login

Here's a new PR which has been rebased from develop, adding HOTP login.
These two lines could be folded into the `set_otp_secret` method below, but I thought it better to be explicit about it.  I can change this if you want.