`bridge_token:` with an empty YAML value became str(None) == "None" (and a whitespace-only value stayed " "). Both are truthy, so connect() skipped the auto-generated token and _authorized() accepted any wake/activity POST carrying that header. Same class as the null-secret fixes for LINE and WhatsApp Cloud in this stack.