WL-3576 : Acc to Jira we weren't going to do checks if the user was logged in

I've moved the security stuff out of the userId==null check.
But we still need to/can do this check as we put different attributes in the request depending on whether the user is logged in or not