Pass true identity ID into provePossession().
Throw UnexpectedValueException when auth token is not an Identity.