session + salts + otp rediect