It is valid for authentication to return nil