Guard against passcode-replay on /login and /send