* Actually verify the assertion (at the browserid.org website) and return the parsed results.
*/
private static Assertion verifyOnce(String assertion, String audience) throws IOException {
RequestBuilder request = new RequestBuilder(VERIFY_LINK, HttpMethod.POST);
request.addParam("assertion", assertion);
request.addParam("audience", audience);
HttpResponse response = request.execute();
if (response.getResponseCode() != HttpServletResponse.SC_OK)
throw new IllegalStateException("Bad response code: " + response.getResponseCode());