should we allow null here and skip the check if no security context is defined?