It looks like allowUnverified has crept into here.