Limiting version dependency to 3.0
Check for Security.token before setting test session state

Otherwise we'll get into a catch22 if it's not set:
The manifest includes this _config.php, which in turn
throws a fatal exception on the token not existing.
It would be recreated a couple of lines further down in Core.php
when the ConfigManifest is pushed, but never gets this far.
Merge remote-tracking branch 'origin/0.1'

Conflicts:
	composer.json