Revisit OTP callback usage & corresponding tests

Some tests need to be disabled because the CredentialSource approach to client credential acquisition does not mesh with the way OTP sometimes needs to acquire a new password for a reset operation. We need to come up with a way to establish separate credential acquire strategies for authenticate versus reset.