User object in token can be empty
Merge pull request #2 from patrickli/nullable-user

User object in security token can be empty