anchor.diff:          Rest3 ->               <<$+,Rest3/binary>>
       end.
   
  -check_re_hash(SeCo, _Account, _OldToken, _NewToken, []) ->
  -    authenticate_fail(SeCo,"Invalid account credentials. Please retry");
  -check_re_hash(SeCo, Account, OldToken, NewToken, [pwdmd5|Types]) ->
  +check_re_hash(SeCo, _Account, _OldToken, _NewToken, Unregister, []) ->
  +    authenticate_fail(SeCo, "Invalid account credentials. Please retry", Unregister);
  +check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, [pwdmd5|Types]) ->
       case lists:member({pwdmd5,OldToken},Account#ddAccount.credentials) of
           true ->  
               re_hash(SeCo, {pwdmd5,OldToken}, OldToken, NewToken, Account);
           false ->
  -            check_re_hash(SeCo, Account, OldToken, NewToken, Types)
  +            check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, Types)
       end;
  -check_re_hash(SeCo, Account, OldToken, NewToken, [Type|Types]) ->
  +check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, [Type|Types]) ->
       case lists:keyfind(Type,1,Account#ddAccount.credentials) of
           {Type,{Salt,Hash}} ->
               case hash(Type,Salt,OldToken) of
                   Hash ->
                       re_hash(SeCo, {Type,{Salt,Hash}}, OldToken, NewToken, Account);
                   _ ->
  -                    authenticate_fail(SeCo,"Invalid account credentials. Please retry")
  +                    authenticate_fail(SeCo, "Invalid account credentials. Please retry", Unregister)
               end;
           false ->
  -            check_re_hash(SeCo, Account, OldToken, NewToken, Types)
  +            check_re_hash(SeCo, Account, OldToken, NewToken, Unregister, Types)
       end.
   
   find_re_hash(SeCo, Account, NewToken, []) ->
  
positive.code:                     imem_cache:write(CacheKey,ACF),
                      ACF;
                  _ ->
                      authenticate_fail(SeCo,{"Invalid accessCheckFun", AccessCheckFunStr}) 
              end;    
          [ACF] when is_function(ACF,1) -> ACF;
          Err -> authenticate_fail(SeCo,{"Invalid accessCheckFun", Err})
      end,
      NewSessionCtx = SessionCtx#ddSessionCtx{networkCtx=NetworkCtx},
      {AccountName1, AccountId1} = case AccessCheckFun(NewSessionCtx#ddSessionCtx.networkCtx) of
          true ->         
              {AccountName0, AccountId0};                                         %% access granted
          false ->        
              authenticate_fail(SeCo,{"Network access denied",NetworkCtx});       %% access denied
          AccountName0 -> 
              {AccountName0, AccountId0};                                         %% accountName confirmed by network
          Name when is_binary(Name), AccountName0 == undefined ->                 %% accountName defined by network
              case if_select_account_by_name(SKey, Name) of
                {[#ddAccount{locked='true'}],true} ->
                    authenticate_fail(SeCo,"Account is locked. Contact a system administrator");
                {[#ddAccount{id=AccId}],true} ->
                    {Name, AccId};
                {[],true} ->
                    authenticate_fail(SeCo, {"Access denied for", Name})
              end;
          _ ->
              authenticate_fail(SeCo,"Account name conflict")                      
      end,
      AuthFactors = [access|SeCo#ddSeCo.authFactors],
      auth_step_succeed(SeCo#ddSeCo{authFactors=AuthFactors, sessionCtx=NewSessionCtx, accountName=AccountName1, accountId=AccountId1});
  
negative.code:                 [#ddAccountDyn{lastFailureTime=LocalTime}] ->
                      %% lie a bit, don't show a fast attacker that this attempt might have worked
                      if_write(SKey, ddAccount, Account#ddAccount{lastFailureTime=LocalTime,locked='true'}),
                      authenticate_fail(SeCo, "Invalid account credentials. Please retry", true);
                  _ -> ok
              end,
              ok = check_re_hash(SeCo, Account, Token, Token, true, ?PWD_HASH_LIST),
              seco_register(SeCo#ddSeCo{accountName=Name, accountId=AccountId, authFactors=[pwdmd5]}, authenticated);     % return SKey only
          {[],true} ->    
              authenticate_fail(SeCo, "Invalid account credentials. Please retry", true)
      end.
  
  -spec auth_start(atom(), any(), ddCredential()) -> {ddSeCoKey(),[ddCredRequest()]} | no_return(). 
  