The JCR implementation doesn't support anonymous access right now. One could emulate anonymous access by creating a guest user, but that requires custom code, adding an actual user in the authentication store, managing the password for the user, etc. It would be nice if DNA just support anonymous users in a configurable fashion and defaulted this anonymous access to disabled.