[security] allow create notify token without model set.