if user is anonymous, shouldn't we be able to return an empty set without a fetch?  I thought that was how it worked.  not sure when this changed.  actually, this looks to me like the permissions system got badly de-optimized at some point.