Would this be a violation of the BrowserID protocol? Should we actually fail instead?