Just pulling these changes (yeah, over the weekend whilst I should be with my boy...) but why do you expose the read API by default now, and ignore the `allowAnonymous` checks I put in place? Or was that unintentional?