Setting pam otpw *after* pam_unix, for dovecot failed auth messages.

I think it's nice that it first asks the usual password, and then offers the
otpw one if enabled. That enables dovecot to show the last pam prompt.

I also add the dovecot option for that.