strongloop/loopback — pull request #92 by ritch (2013-12-11 00:06:49+00:00)
Title: Allow requests without auth tokens

/to @raymondfeng

This switches up the behavior for authentication a bit as we discussed. For anyone else paying attention, before this patch a valid `AccessToken` was required to make any request. This removes that check and uses the `ANONYMOUS` token (a token with id `$anonymous`) by default.

This patch also adds default `AccessToken` ACLs for preventing any malicious access to to the tokens themselves.