[Security] add the $token argument to checkPostAuth()#20066