might be clearer as `verifyPersonaLogin`