`cas.rb`, line 206 - if `authenticator.find_user` returns nil, and `@ticketed_user` hasn't been set, valid_credentials is always true.