You may be right, if we are not in a firewall security.context service does not exist ?

In my memory (i'm may be wrong) we always have a security.context, it's just the getToken method that can return a null value when we are not in a firewall. (The check of this is done in the updateUserContext method of the provider)