Don't assume our secret is base32 encoded.

According to https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm
secrets are only base32 encoded in gauthenticator and gauth friendly providers.

hotp.go

@@ -90,7 +90,8 @@ func hotpFromURL(u *url.URL) (*HOTP, string, error) {
 
 	key, err := base32.StdEncoding.DecodeString(secret)
 	if err != nil {
-		return nil, "", err
+		// secret isn't base32 encoded
+		key = []byte(secret)
 	}
 	otp := NewHOTP(key, counter, digits)
 	return otp, label, nil

otp_test.go

@@ -79,10 +79,7 @@ func TestBadURL(t *testing.T) {
 		"foo",
 		"otpauth:/foo/bar/baz",
 		"://",
-		"otpauth://hotp/secret=bar",
-		"otpauth://hotp/?secret=QUJDRA&algorithm=SHA256",
 		"otpauth://hotp/?digits=",
-		"otpauth://hotp/?secret=123",
 		"otpauth://hotp/?secret=MFRGGZDF&digits=ABCD",
 		"otpauth://hotp/?secret=MFRGGZDF&counter=ABCD",
 	}

totp.go

@@ -152,7 +152,8 @@ func totpFromURL(u *url.URL) (*TOTP, string, error) {
 
 	key, err := base32.StdEncoding.DecodeString(secret)
 	if err != nil {
-		return nil, "", err
+		// secret isn't base32 encoded
+		key = []byte(secret)
 	}
 	otp := NewTOTP(key, 0, period, digits, algo)
 	return otp, label, nil