[security] allow create notify token without model set.
Release 0.8.6