anonymous -> readonly, twitter auth -> read/write