anchor.diff:                      imem_cache:write(CacheKey,CF),
                       CF;
                   _ ->
  -                    authenticate_fail(SeCo,{"Invalid authenticatonRequireFun", AuthRequireFunStr}) 
  +                    authenticate_fail(SeCo,{"Invalid authenticatonRequireFun", AuthRequireFunStr}, true) 
               end;    
           [AF] when is_function(AF,2) -> AF;
  -        Err1 -> authenticate_fail(SeCo,{"Invalid authenticatonRequireFun", Err1})
  +        Err1 -> authenticate_fail(SeCo,{"Invalid authenticatonRequireFun", Err1}, true)
       end,
       case AuthRequireFun(AFs,SessionCtx#ddSessionCtx.networkCtx) of
           [] ->   
  
positive.code:     #ddSeCo{skey=SKey, accountId=AccountId0, authFactors=AFs} = SeCo, % may not yet exist in ddSeco@
      case if_select_account_by_name(SKey, Name) of
          {[#ddAccount{locked='true'}],true} ->
              authenticate_fail(SeCo,"Account is locked. Contact a system administrator");
          {[#ddAccount{id=AccountId1} = Account],true} when AccountId0==AccountId1; AccountId0==undefined ->
              LocalTime = calendar:local_time(),
              case if_read(SKey, ddAccountDyn, AccountId1) of
                  [#ddAccountDyn{lastFailureTime=LocalTime}] ->
                      %% lie a bit, don't show a fast attacker that this attempt might have worked
                      if_write(SKey, ddAccount, Account#ddAccount{lastFailureTime=LocalTime,locked='true'}),
                      authenticate_fail(SeCo,"Invalid account credentials. Please retry");
                  _ -> ok
              end,
              ok = check_re_hash(SeCo, Account, Token, Token, ?PWD_HASH_LIST),
              auth_step_succeed(SeCo#ddSeCo{accountName=Name, accountId=AccountId1, authFactors=[pwdmd5|AFs]});
          {[#ddAccount{}],true} -> 
              authenticate_fail(SeCo,"Account name conflict");
          {[],true} ->
              authenticate_fail(SeCo,"Invalid account credentials. Please retry")
      end;
  auth_step(SeCo, {smsott,Token}) ->
      #ddSeCo{skey=SKey, sessionCtx=SessionCtx, accountName=AccountName, accountId=AccountId, authFactors=AFs} = SeCo,
      case sms_ott_mobile_phone(SKey, AccountId) of
          undefined ->    
              authenticate_fail(SeCo, "Missing mobile phone number for SMS one time token");
          To ->           
              case (catch imem_auth_smsott:verify_sms_token(SessionCtx#ddSessionCtx.appId, To, Token, {smsott, #{}})) of % TODO : smsott with parameters
                  ok ->
  
negative.code:                 [#ddAccountDyn{lastFailureTime=LocalTime}] ->
                      %% lie a bit, don't show a fast attacker that this attempt might have worked
                      if_write(SKey, ddAccount, Account#ddAccount{lastFailureTime=LocalTime,locked='true'}),
                      authenticate_fail(SeCo, "Invalid account credentials. Please retry", true);
                  _ -> ok
              end,
              ok = check_re_hash(SeCo, Account, Token, Token, true, ?PWD_HASH_LIST),
              seco_register(SeCo#ddSeCo{accountName=Name, accountId=AccountId, authFactors=[pwdmd5]}, authenticated);     % return SKey only
          {[],true} ->    
              authenticate_fail(SeCo, "Invalid account credentials. Please retry", true)
      end.
  
  -spec auth_start(atom(), any(), ddCredential()) -> {ddSeCoKey(),[ddCredRequest()]} | no_return(). 
  