code: func (s *AuthServer) GetSignupTokenData(token string) (user string, qrCode []byte, err error) {
  	// Rotate OTP secret before the signup data is fetched (signup page is
  	// rendered). This mitigates attacks where an attacker just views the signup
  	// link, extracts the OTP secret from the QR code, then closes the window.
  	// Then when the user signs up later, the attacker has access to the OTP
  	// secret.
  	st, err := s.rotateAndFetchSignupToken(token)
  	if err != nil {
  		return "", nil, trace.Wrap(err)
  	}
  
  	// TODO(rjones): Remove this check and use compare and swap in the Create*
  	// functions below. It's a TOCTOU bug in the making:
  	// https://en.wikipedia.org/wiki/Time_of_check_to_time_of_use
  	_, err = s.GetPasswordHash(st.User.Name)
  	if err == nil {
  		return "", nil, trace.Errorf("user %q already exists", st.User.Name)
  	}
  
  	return st.User.Name, st.OTPQRCode, nil
  }
docs: // GetSignupTokenData returns token data (username and QR code bytes) for a
  // valid signup token.