HDFS-3639. JspHelper#getUGI should always verify the token if security is enabled. Contributed by Eli Collins