add security token back, but not for anonymous users