authToken could be null here? tenanted="true" and a service-admin-roles are defined. validateTenant(...) fails the tenant check and returns null.

Then we get a lovely NPE.