Add step to invalidate auth code after is has been used