introduce auth code AbstractSession
test length of generated state
remove unused `use`