added more tests and changed verify_code api to not use sessionToken