api: System: add invalidSecurityTokenStartPath property