Don't allow visually similar characters in alphanumeric OTP

[aspiers]

I would suggest that we don't want to allow both 0 and O, also maybe not both 1 and I. This can be fixed in a follow-up.

Originally posted by @aspiers in #14 (comment)