reject callback promise if token signatures fail to verify; verify nonce; ignore __ready__event emitted by Twitter auth page in popup