Major Description
When a policy resource contains a token (such as {USER}), and request context does not have an entry for the token (in this case, USER), then the replacement fails and the expanded policy resource is set to null. A null policy-resource will not match any policy, and may cause NPE.
In such case, the original policy resource string should be returned as the expanded policy resource string.