Allow unauthenticated access over HTTP to all resources, optionally (fix...

...es #1594).

@abyrd, take a look at this. It works at a first pass, but I can't test if the roles still work over HTTPS in secure mode, because HTTPS doesn't work for me.