I think it would be better to check against `is None` here and have the default be `None` in the middleware (partially just to separate the two cases, list and no-list, better but also because it gives us a way to disable access).