XWIKI-9052 : Unregistered users can still see everything in the wiki even if right to view pages for Unregistered users is explicitly set to deny.

In contrary to checkAccess, hasAccessLevel didn't check whether authentication is needed. 
The problem was that the REST API was relying on hasAccess level to know whether the current user had the right to access the ressources.