fix anonymous users & decorator order
putting @login_required
first shows a page asking the user to log in,
so this is the UX fix; the new AnonymousUser class should help avoid any
sentry nags due to the missing attribute on FlaskLogin's default
anonymous user