Example is very misleading

[ieure]

It looks like the default behavior in authenticate* is allow-anon? true. This makes the example extremely misleading, since the supposedly secured app allows any request by default, and you must dig into the source to discover why this is so.

Honestly I don't know why this is an option vs. not using friend for things that should have anonymous access, but this is a rotten thing to omit in an example.