true, we always have a token, otherwise SecurityContext screams.