The Apache auth framework handles stacked aaa modules fine. So, some of

the auth logic in here was superfluous.

In short, the auth_check phase needs only bother itself with:
  Require persona-idp

The other cases like 'Require valid-user','Require user foo@bar.com'
will be handled by core modules. This way, it works as expected and
doesn't require any re-implementation.

For instance:

<Location />
  AuthType Persona
  Require user gozer@mozilla.com
  Require user bob@mozillafoundation.org
  Require persona-idp mozilla.org
</Location>

Will work as expected.

While I was at it, I removed the userfile support, since it can
easily be implemented with the 'Require group' stuff.