I've got a question about transfer. please help

[duskdawn]

Here is the situation:
I bought a domain at sedo. I requested the domain to be transfered to my prefered registrar godaddy, and the domain is now at WWD.

First Sedo emailed me and gave me an AUTH code asking me to initiate a transfer at godaddy. So I paid the transfer fee and did initiate with that AUTH code at godaddy. The transfer status remains "Pending Current Registrar Approval " now.

Today I got a letter from the seller forwarded by sedo. Actually it was an email sent by godaddy to the Administrative address (the seller's email address) of that domain.
The email goes like this:

Follow these steps to proceed with the transfer:
To ensure the safety of your information, log in to your account from the
GoDaddy home page (instead of clicking on unidentifiable links, pop-ups,
etc.). This will guarantee that your information is secure and encrypted.
1. Go to godaddy.com
2. Click on My Account
3. Enter your log in name or customer number and password and click
Secure Login
4. Select "Pending Domain Transfers" from the Domain Names drop-down
5. Select the domain and click on "Transaction ID and Security Code
Required" in the Status column
6. Enter the Transaction ID and Security Code contained within this
email and proceed
IMPORTANT: If you do not respond, the domain names listed above will not be
transferred to us.

And there is a Transaction ID and Security Code.
But to me the Transaction ID and Security Code cannot be input because the transfer status already becomes "Pending Current Registrar Approval"

My question is
1. When you buy or sell domains at sedo, what's the common procedure for the domain transfer?
2. When to enter the Auth code, Transaction ID and Security Code. What's the difference between these. I entered Auth code and cannot enter the other two, so what's the use of Transaction ID and Security Code?
3. Why sedo has the auth code before the transfer begins?
4. Should the buyer always get the Transaction ID and Security Code from the seller because the administrative email address of that domain is still the seller's?


Plenty of questions. Just want to learn something from each step, so thank you for your input.