Test security token before retrieving user

If security layer is disabled for this URL, the security token is null: we need to test it.