if the `path` is `null` (which can happen, see above), does it make sense to continue the logic and call the `authorizer` ?