OTP can be bypassed by refreshing on the OTP prompt page..

There is one more thing to consider here.

All of the "Auth" Policy Items expect that the password will be in an encrypted format. The Logon Page inputs can be "text" or "password". If you set it to "text", then the variable is set up to be unencrypted. If you set it to "password", then it's encrypted. The "Invalid Ciphertext" error message happens when whatever session variable that the Policy Item was trying to interrogate was NOT encrypted or was empty. If it was plaintext, the error would be produced.