feat(headless): scope escape hatch + authenticated verification (#241)