I suppose here I need the userid. Will that come back in the response from the verifier? Or should I just check the assertion payload directly?