After all big companies has change to sms code authentication, we just realized this is a bad pattern, please take out all that y get back to "click a link in this mail" pattern, looks more secure.