REFACTOR: httpSecurityToken

Rename httpSetSecurityToken to httpAddSecurityToken
Make httpCreateSecurityToken private. Uses should call httpGetSecurityToken only.