How is the «resource ref='anonymous'» webapi.xml rule handled for a request?

See also: