support TAN tokens

see https://edumfa.readthedocs.io/en/latest/tokens/tokentypes/tan.html

this is essentially a PAPER token where the OTPs can be used in any order