my idea was to ignore any exception and just forbid things. but if anything, we could move that to the js controller as that is the one where we really want a maximum non-failing behaviour - otherwise if something goes wrong the whole website turns into a 500 even for non-logged in users.

or do you think i should just drop the try-catch? (we check if the security context has a token - there is an exception if there is no token, but not sure if a unexpected type of token could also lead to an exception)