yes anonymous has a token. but you have not even an anonymous user if there is no firewall configured on a route.