The codes are hashed and saved to the db. The code is marked as used once a valid code is submitted. The code is valid for 1 hour. The codes are no longer saved to the session.
When user enters valid sms code they are redirected to the dashboard. Otherwise, form errors are present.