fix: unallow anonymous on redirect