o We still want to find users with too short code; just not
  authenticate.