validateAccount(ident username, string code) {
  assume exists /account[username]/code; # implies existence of the account
 
  assume /account[username]/code = code;
 
  remove /account[username]/code;
}