Store challenge from handleGetChallenge in session, then verify against it in handleSolve. Previously a fresh challenge was generated for verification, making auth trivially bypassable.