it is perfectly fine for the SecurityToken.Id to be null.
Logging is a feature for GA.