[#6831] Fix tests for new rest api auth logic

You must explicitly specify anon user for a test rest request now,
since the user will not automatically become anon if oauth or api key
authentication fails (instead, auth falls back to session cookie,
which, in the case of functional tests, would by default be an
admin user.

Also, an authorization failure for a rest request will now return
a 403 instead of a 401, since the user will be authenticated
instead of implicitly set to anon like before (in tests where
anon is not explicitly used).

Signed-off-by: Tim Van Steenburgh <tvansteenburgh@gmail.com>