All correlations must die: Assessing the significance of a stochastic gravitational-wave background in pulsar timing arrays