Step 4 - Verify the Identity (cont)
decide the action
1) redirect to a user setup URL
2) redirect to a user cancel URL
3) if verified, we're all signed in