It looks like this was changed from `undefined` to false-y.

I think we used to use `undefined` so a handler could return `null` to indicate that it handled and blocked the login. It looks like we're doing that with explicit object returns now.

These comments should be updated.