The TOTP Credential handlers should check all devices and not just a specific one (if device is null).