ensure verify correctly rejects wrong scopes