Update rest.properties

updating the rest endpoint rules to allow ROLE_ANONYMOUS and IS_AUTHENTICATED_ANONYMOUSLY (which includes both authenticated 'staff'/admin and authenticated non-'staff')