prior to this change, allow_anonymous is only true | false
when set to 'false', even if the client is connected without
a username, the auth backends will be invoked.
this commit introduced a new config value `false_quick_deny`
to deny access immediately without involving auth backends