Doesn't `loginWithSignedToken` return a restCtx with which you should be validating authentication? Below, you continue to use the anonymousTenantRestContext, which should always be anonymous, even if this succeeded.