Actually this should test adding an `AnonymousUser`. A  `User` object is 'always' authenticated.