Retrieving tokens from an insecure cluster throws an NPE. This prevents copies from insecure to secure clusters. The problem is in DFSClient.getDelegationToken(). It attempts to set the service and log the token w/o a null check.
FetchDT will also throw exceptions when fetching tokens from an insecure cluster.