A couple of notes:

In the project, since it is intended to do something visible to the user, when the certificate security code is invalid the rejected certificate is printed - In the real world, of course, the user might be logged out. (As it happens, the validity check conists of ensuring that the entered code exists on the server and whether the certificate number returned from the server is six characters long - Quite secure . . . )

Also, to avoid the requirement for me to generate security codes and valid certificate numbers and then emailing them to my site's visitors, a group of coded certficate numbers have been placed on file but they are semi-static and not deleted once you've printed a certificate.