getSecurityQuery returns None when caller is superuser. Avoid passing it
to buildSQLQuery, as it would mistake security_query for a column name.