[api] increase coverage of application controller...

For this I reworked the handling of anonymous access. It's suprising
that we handle it so differently depending on login mechanism. And as
most of our tests rely on the code path used by tests, I had to touch
them too ;(