Serialise event's `identityId`, not its non-existent `id`.
Fix DomainException when no second factor in possession.
Fix issues suggested by Scrutinizer.