Previously if unauthenticated() experienced an AnonymousAuthenticationToken it would not match. This commit ensures that if the user is anonymous (not just null) unauthenticated() works. Fixes gh-3409
Previously if unauthenticated() experienced an AnonymousAuthenticationToken it would not match. This commit ensures that if the user is anonymous (not just null) unauthenticated() works. Fixes gh-3409