Check a Confirmation Code

Requires permissions: Guardian or NewJoiner or Parent or Student

Confirms a one-time code. Codes are single-use, expire after 10 minutes and allow five attempts — the attempt counter is atomic, and is the real limit; the endpoint throttle keys on a client-supplied header and is defence in depth only.