Looks pretty solid to me. I'd make sure to test it without javascript before employing. I believe I've seen some OTP implementations floating around that generate word-like combinations, which might be a good idea if you want to use longer codes than that.

I'm a bit disappointed you removed words like POOP though – it's nuggets like these that make one's day.