fix the session bug, and insert the otp into the signup procedure