Why ask BE authz when the request is anonymous?