I've been reviewing the debug output and I have found the problem, although I don't know the solution. My debug data reports:
1. User not found, returning anonymous 2. anonymous user not found, returning NoUser
I believe this would explain why the policy for anonymous does not seem to work. Can anyone suggest how I can get the anonymous user to be recognized by the system?