Worth explicitly stating that the empty set means no requirements on which handlers authenticated credentials, rather than there being no handlers that would be acceptable?