@fmarier - this is a strangeness in Persona. If a user who signs with a primary address is not authenticated to Persona, an assertion is first generated with the audience login.persona.org to sign the user into Persona, and once that occurs, another assertion is generated to sign the user into the RP.