untested but seemingly correct Mozilla Personas authentication