Ensure RBAC is respected if API keys are not enabled

Anonymous authentication is allowed if API keys are not configured, and this applies if RBAC is enabled