Your entire authorization model is "if confused, grant." The else branch literally comments its own guess and hands over the keys — that's not security, that's a bouncer who lets everyone in and hopes for the best.