if verify_callback raises an exception, the session will be invalidated.