Don't return 1-length code candidates on wildcard

When the user enters e.g "d*d", we were returning the candidates
associated to the "d" key, because "d" starts with "d" and ends with
"d".

This is wrong, we need to check that the length of the code is at least
the sum of the lengths of the user inputs.