Type check before unset()

Calling unset() on string indices fails fatally on 5.3.x and lower.

Fixes #3027

lib/Cake/Controller/Component/SecurityComponent.php

@@ -229,7 +229,7 @@ public function startup(Controller $controller) {
 			}
 		}
 		$this->generateToken($controller->request);
-		if ($isPost) {
+		if ($isPost && is_array($controller->request->data)) {
 			unset($controller->request->data['_Token']);
 		}
 	}