Updated bundle to configure allowable methods via an array, with "header" being the default.
Updated auth provider and firewall listener to allow anonymous authentication.
Tweaked ApiSecurityListener.