User object in security token can be empty

For example, authenticated with an application access token with FOSOAuthServerBundle.