add anonymous user, define anonymous user roles in security config, deny URLs by default. see #819