BS-400, avoid npe if accessing api without accessing login.jsp first.