fixed mock verify count, to account for the handling of login-related hasPermission call before PEP.