should be possible to issue anonymous api tokens
lift common helpers to the base resource
use an anonymous token for unauth'd api access
treat empty permissions as world
turn on authz checking for search