Currently, when anonymous access is enabled, a request with an invalid/expired/wrong access token or an API Key would fallback to being authenticated as the anonymous user, as if the request wouldn't contain any Authorization header. This might be a confusing behavior for users and we should be explicit in our responses about treating no credentials and wrong credentials differently, even when anonymous access is enabled.