just audited the browserid-verify code, we're good for non-objects