Prevent NPE for IdentityContext, not authorized
Create and pass identity context in API