Play nicely with third party scanners that don't know about 'root'

Still seeing a few sporadic accounts with folks with custom scanners that are choking on the required `root` arg when invoking `Scan()` directly.  No reason it needs to be required, since it fails gracefully when `None` anyway.