if i am not mistaken, we needed to add on-invalid="ignore" for the CmfCreateBundle for example: https://github.com/symfony-cmf/CreateBundle/blob/master/Resources/config/services.xml#L55 for that reason. there is only a context if we have a firewall at the current path. if there is a firewall but the user is not logged in because anonymous access is allowed, there is a context but no token.