* using update handler to invalidate auth code after use