I've used `false` as `null` would break BC (see the fake routes in the security providers).