pboc: add input constraints, app: change the path of sms validate code matching