OTP can be bypassed by refreshing on the OTP prompt page..

I see that. I have that set so that the http-auth form pulls the correct field for clickatell...perhaps I can rename it...either way though on the variable assign before the "Prompt for Passcode" I just added session.logon.last.password and set it to something manually there and tried it again with the same result...it's strange that it doesn't do this on mobile devices or when i change that password field type....let me run through it a few more times.