There was a bug in a php app where someone had typed `flase` which evaluated to `"flase"` which is truthy so the authentication check passed.