anchor.diff:                          {error,Err2} -> 
                               case ?GET_CONFIG(smsTokenSendingErrorSkip,[SessionCtx#ddSessionCtx.appId],false) of
                                   true -> {seco_register(SeCo, authenticated),[]};   % authentication success, return {SKey,[]} 
  -                                _ ->    authenticate_fail(SeCo,{"SMS one time token sending failed", Err2})
  +                                _ ->    authenticate_fail(SeCo,{"SMS one time token sending failed", Err2}, true)
                               end
                       end
               end;
  
positive.code:                     ?Error("Token validation failed ~p", [Error]),
                      case ?GET_CONFIG(smsTokenValidationRetry,[SessionCtx#ddSessionCtx.appId],true) of
                          true -> {seco_register(SeCo),[{smsott,#{accountName=>AccountName,to=>To}}]};     % re-ask for same token
                          _ ->    authenticate_fail(SeCo, "SMS one time token validation failed")
                      end
              end
      end;
  auth_step(SeCo, Credential) ->
      authenticate_fail(SeCo,{"Invalid credential type",element(1,Credential)}).
  
  -spec authenticate_fail(ddSeCoKey(), list() | tuple()) -> no_return(). 
  authenticate_fail(SeCo, ErrorTerm) ->
      seco_unregister(SeCo),
      ?SecurityException(ErrorTerm).
  
  -spec auth_step_succeed(ddSeCoKey()) -> ddSeCoKey() | [ddCredRequest()] | no_return(). 
  
negative.code:         Rest3 ->               <<$+,Rest3/binary>>
      end.
  
  check_re_hash(SeCo, _Account, _OldToken, _NewToken, Unregister, []) ->
      authenticate_fail(SeCo, "Invalid account credentials. Please retry", Unregister);
  check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, [pwdmd5|Types]) ->
      case lists:member({pwdmd5,OldToken},Account#ddAccount.credentials) of
          true ->  
              re_hash(SeCo, {pwdmd5,OldToken}, OldToken, NewToken, Account);
          false ->
              check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, Types)
      end;
  check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, [Type|Types]) ->
      case lists:keyfind(Type,1,Account#ddAccount.credentials) of
          {Type,{Salt,Hash}} ->
              case hash(Type,Salt,OldToken) of
                  Hash ->
                      re_hash(SeCo, {Type,{Salt,Hash}}, OldToken, NewToken, Account);
                  _ ->
                      authenticate_fail(SeCo, "Invalid account credentials. Please retry", Unregister)
              end;
          false ->
              check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, Types)
      end.
  
  find_re_hash(SeCo, Account, NewToken, []) ->
  