Allow `null` in appId check. This can happen when a client passes
`undefined` for appId and it gets translated to `null` by DDP.