Decodes opaque session id ("code") into server-side id, validating code purpose (type) and expiration time.