Support anonymous users with AUTHENTICATION_MODE=="host"

Simply assume an anonymous user if there is no REMOTE_USER in the WSGI
environment.

Exactly what this translates to in practice depends on the host server's
configuration.  One possibility is that it is configured to support
anonymous access to specific paths only, such as /tutorial.