prepped firebase security rules
restored the demo (anonymous) functionality