Support _not_ having roles or tokens fetched from ident data in `GET_IDENT`

[kjellmorten]

It's possible to configure other paths to extract roles and tokens from, but there's no way of saying that we only wants, say, roles. A null instead of a path would be one way of signaling this.