Confirming new behavior is correct.

If the sent device secret is ever null when authenticating, treat it as an invalid request.