Are we allowing allowUnverified as a GET parameter? If not, the req.query should be taken off.