Pass tokens that are not related to users

Hej,

all your examples recommend to pass `false` if the authentication fails.

I think this should be valid, if there is no user related to the token (e.g. the token was issued using client_credentials).

Cheers
Niko