The issue may happen if somebody manages to attach an API token when "user is not a valid user in the backend SecurityRealm." (http://javadoc.jenkins-ci.org/hudson/model/User.html#impersonate%28%29).