Oh, it's outside because it's later used by the `navigator.id.watch` `onlogin` callback to determine which form to use for submitting the assertion.