diff --git a/development.ini b/development.ini
index ebc07f1..038ffa7 100644
--- a/development.ini
+++ b/development.ini
@@ -37,7 +37,7 @@ session.timeout = 31104000
 session.max_age = 31104000
 session.reissue_time = 15552000
 session.samesite = none
-session.secure = True
+session.secure = False
 
 ###
 # custom app configuration.
diff --git a/remarkbox/views/authentication.py b/remarkbox/views/authentication.py
index 5f42650..2f74691 100644
--- a/remarkbox/views/authentication.py
+++ b/remarkbox/views/authentication.py
@@ -104,8 +104,8 @@ def verification_challenge(request):
         # get or create a User object from the posted email.
         user = get_or_create_user_by_email(request.dbsession, email)
 
-    if "submit" in request.params:
-        if raw_otp and user.check_password(raw_otp):
+    if raw_otp:
+        if user.check_password(raw_otp):
             # success: the user was verified.
             user.verified = True
             msg = ("Welcome {}".format(user.name), "success")