fixed: pending client expiration + prevent double use of code