Check for Security.token before setting test session state

Otherwise we'll get into a catch22 if it's not set:
The manifest includes this _config.php, which in turn
throws a fatal exception on the token not existing.
It would be recreated a couple of lines further down in Core.php
when the ConfigManifest is pushed, but never gets this far.

_config.php

@@ -1,5 +1,8 @@
 <?php
-if(DB::get_alternative_database_name()) {
+if(
+  Config::inst()->get('Security', 'token')
+  && DB::get_alternative_database_name()
+) {
   require_once BASE_PATH . '/vendor/autoload.php';
 	
 	// Register mailer