when using httpauth, anonok isn't