cope with anonymous users in get_access_for