fix anonymous user access check