I think we should either:

a. Just pass in the whole request object to the verify method; or
b. Be more transparent to the fact that this isn't some "profile" object, it's actually just a dump of request headers; or
c. Pick just the shibboleth headers we care about off the request and assemble it into an object that we can call a `profile`