`verify()` now raises `InvalidToken`, but this should be documented here.