when an ElasticHttpRequest lacks any 'auth.identify:*' headers, then treat the user as anonymous