I think you are missing something, and I will need to review.  I believe that now, there is never a role-id of Anonymous (Role Anyone)  of AnyoneSignedIn (Codename Auth?) in the lists, that is handled in the logic.  With Anonymous, there is no list, it is only allowed for that special role.  With AnyoneSignedIn, I think that is an empty roles list because everyone who has any role is in it.