anchor.diff:                  [#ddAccountDyn{lastFailureTime=LocalTime}] ->
                       %% lie a bit, don't show a fast attacker that this attempt might have worked
                       if_write(SKey, ddAccount, Account#ddAccount{lastFailureTime=LocalTime,locked='true'}),
  -                    authenticate_fail(SeCo,"Invalid account credentials. Please retry");
  +                    authenticate_fail(SeCo, "Invalid account credentials. Please retry", true);
                   _ -> ok
               end,
  -            ok = check_re_hash(SeCo, Account, Token, Token, ?PWD_HASH_LIST),
  +            ok = check_re_hash(SeCo, Account, Token, Token, true, ?PWD_HASH_LIST),
               seco_register(SeCo#ddSeCo{accountName=Name, accountId=AccountId, authFactors=[pwdmd5]}, authenticated);     % return SKey only
           {[],true} ->    
  -            authenticate_fail(SeCo,"Invalid account credentials. Please retry")
  +            authenticate_fail(SeCo, "Invalid account credentials. Please retry", true)
       end.
   
   -spec auth_start(atom(), any(), ddCredential()) -> {ddSeCoKey(),[ddCredRequest()]} | no_return(). 
  
positive.code:                         {error,Err2} -> 
                              case ?GET_CONFIG(smsTokenSendingErrorSkip,[SessionCtx#ddSessionCtx.appId],false) of
                                  true -> {seco_register(SeCo, authenticated),[]};   % authentication success, return {SKey,[]} 
                                  _ ->    authenticate_fail(SeCo,{"SMS one time token sending failed", Err2})
                              end
                      end
              end;
  
negative.code:         Rest3 ->               <<$+,Rest3/binary>>
      end.
  
  check_re_hash(SeCo, _Account, _OldToken, _NewToken, Unregister, []) ->
      authenticate_fail(SeCo, "Invalid account credentials. Please retry", Unregister);
  check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, [pwdmd5|Types]) ->
      case lists:member({pwdmd5,OldToken},Account#ddAccount.credentials) of
          true ->  
              re_hash(SeCo, {pwdmd5,OldToken}, OldToken, NewToken, Account);
          false ->
              check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, Types)
      end;
  check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, [Type|Types]) ->
      case lists:keyfind(Type,1,Account#ddAccount.credentials) of
          {Type,{Salt,Hash}} ->
              case hash(Type,Salt,OldToken) of
                  Hash ->
                      re_hash(SeCo, {Type,{Salt,Hash}}, OldToken, NewToken, Account);
                  _ ->
                      authenticate_fail(SeCo, "Invalid account credentials. Please retry", Unregister)
              end;
          false ->
              check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, Types)
      end.
  
  find_re_hash(SeCo, Account, NewToken, []) ->
  