Change default index? policy to false

See gh-17 for initial discussion.  I think that the default provided
before this commit is confusing, because an empty result is not a
good indicator of authorization failure.  Returning false better
communicates "override this is you want it".