added hmac using pepper to validate session's input user code