More unauthenticated user tests;  fixed JSON acls