when faking login, we should set the token in the security context (to be more realistic)
Merge remote-tracking branch 'upstream/security-context-patch'