fix user set api and add support for verification code expiration and refactor algorithm