In some cases we might need to simply check if `authorize` or
`policy_scope` were called, without immediately raising and exception.
In other cases we might be happy if either was called and only want
to raise if neither was called.
All those edge cases are most easily served by exposing lower level
function which just perform the checks and return `true` or `false`.
The `verify_*` methods can then build on top of them to offer a
convenient path for the most common use cases.