A better fix.

framework/base/Application.php

@@ -495,11 +495,10 @@ abstract class Application extends Module
     /**
      * Returns the auth manager for this application.
      * @return \yii\rbac\Manager the auth manager for this application.
-     * Null will be returned if "authManager" is not installed.
      */
     public function getAuthManager()
     {
-        return $this->get('authManager', false);
+        return $this->get('authManager');
     }
 
     /**

framework/web/AccessRule.php

@@ -137,10 +137,14 @@ class AccessRule extends Component
             return true;
         }
         foreach ($this->roles as $role) {
-            if ($role === '?' && $user->getIsGuest()) {
-                return true;
-            } elseif ($role === '@' && !$user->getIsGuest()) {
-                return true;
+            if ($role === '?') {
+                if ($user->getIsGuest()) {
+                    return true;
+                }
+            } elseif ($role === '@') {
+                if (!$user->getIsGuest()) {
+                    return true;
+                }
             } elseif ($user->checkAccess($role)) {
                 return true;
             }