Made verify_pin's UserState a record with a boolean flag to specify whether we want to allow expired certificates