fix permission checking for downloading anonymous requests