Clean whitespace from token

[tjwalch]

Many (all?) authentication apps present the OTP token e g in groups of three ("123 456"). Users should be able to enter the token like it is presented to them, otherwise it is very confusing. Non-skilled users won't understand why they get an error. This PR fixes this by simply removing all whitespace from token before validating.