Allow requests without auth tokens

/to @raymondfeng 

This switches up the behavior for authentication a bit as we discussed. For anyone else paying attention, before this patch a valid `AccessToken` was required to make any request. This removes that check and uses the `ANONYMOUS` token (a token with id `$anonymous`) by default.

This patch also adds default `AccessToken` ACLs for preventing any malicious access to to the tokens themselves.