DEV: pin the rotp gem

Not ready for an upgrade due to: https://github.com/mdp/rotp/issues/98

The policy here is that for cases like this we pin the version and add
a comment explaining why it is pinned.

We can revisit in a few months depending on upstream.

Gemfile

@@ -224,7 +224,9 @@ gem 'logster'
 gem 'sassc', '2.0.1', require: false
 gem "sassc-rails"
 
-gem 'rotp', require: false
+# see: https://github.com/mdp/rotp/issues/98
+gem 'rotp', '5.1.0' , require: false
+
 gem 'rqrcode'
 
 gem 'rubyzip', require: false

Gemfile.lock

@@ -532,7 +532,7 @@ DEPENDENCIES
   redis
   redis-namespace
   rinku
-  rotp
+  rotp (= 5.1.0)
   rqrcode
   rspec
   rspec-html-matchers