Check for Security.token before setting test session state

Otherwise we'll get into a catch22 if it's not set:
The manifest includes this _config.php, which in turn
throws a fatal exception on the token not existing.
It would be recreated a couple of lines further down in Core.php
when the ConfigManifest is pushed, but never gets this far.