NPE in getUserId when no security filter applies