a less sensible way to do this would be to have validate_authorization_code be implemented like this:
correct_authorization_code = generate_authorization_code(serial, expiration, max_users);
return strcmp(correct_authorization_code, authorization_code) == 0;