Fix early return bug in IdentityPolicy.verify()