Generate auth codes using shared_secret.
shared_secret never leaves your browser.