Should this be `return True` instead? Since the default should be to authenticate and then providers implementing non authenticated support could override this method.