Don't assume our secret is base32 encoded.

According to https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm
secrets are only base32 encoded in gauthenticator and gauth friendly providers.

hotp.go

@@ -90,7 +90,8 @@ func hotpFromURL(u *url.URL) (*HOTP, string, error) {
 
 	key, err := base32.StdEncoding.DecodeString(secret)
 	if err != nil {
-		return nil, "", err
+		// secret isn't base32 encoded
+		key = []byte(secret)
 	}
 	otp := NewHOTP(key, counter, digits)
 	return otp, label, nil