Turns out anon user auth is totally busted, workaround