[security] GenericTokenFactory did not handle afterPath correctly, when ...

...it is url.