Security service now works with empty current_user.json object returned on un-authenticated request (this fixes the unexpected login window popups which occured when un-authenticated requests to current_user.json returned a 404)