bug fix. security token should be required.