It is possible to have a null `Authentication` and so the `AuthorizationManager` APIs should allow for passing it in.