Robust, easy-to-implement TOTP for email authentication