1. Remove check for unique confirmation token, since confirm should be associates with (phone, token) pair
2. make token easier to remember by using only 3 digits