If you have the "database" strategy in front of the "openid" one, you wouldn't need the check at all: in normal mode "database" would fail immediately due to valid check failing. During the fallback the control will never reach the "openid" authentication...