Dont send sec-username & sec-roles headers when the user is anonymousUser.

This was discussed on georchestra-dev here : 
https://groups.google.com/forum/?fromgroups#!searchin/georchestra-dev/anonymousUser/georchestra-dev/_2bRfhGH1rg/QdQcf09p4LwJ

Instead of messing up with geoserver's code here https://github.com/georchestra/geoserver/commit/d0dec0e406e113dd6b685d71cac95ad1a7d2a996#diff-31

It'd be much simpler to send no headers to geoserver if the username is anonymousUser. That way, people using 'standard' geoserver installs instead of the forked georchestra-geoserver have no issue, and it's imo nicer.