Does allow-unverified have to go first?