diff --git a/conf/auth.conf b/conf/auth.conf
index cb202a989..37abf84ab 100644
--- a/conf/auth.conf
+++ b/conf/auth.conf
@@ -1,99 +1,99 @@
 # This is an example auth.conf file, it mimics the puppetmasterd defaults
 #
 # The ACL are checked in order of appearance in this file.
 #
 # Supported syntax:
 # This file supports two different syntax depending on how
 # you want to express the ACL.
 #
 # Path syntax (the one used below):
 # ---------------------------------
 # path /path/to/resource
 # [environment envlist]
 # [method methodlist]
 # [auth[enthicated] {yes|no|on|off|any}]
 # allow [host|ip|*]
 # deny [host|ip]
 #
 # The path is matched as a prefix. That is /file match at
 # the same time /file_metadat and /file_content.
 #
 # Regex syntax:
 # -------------
 # This one is differenciated from the path one by a '~'
 #
 # path ~ regex
 # [environment envlist]
 # [method methodlist]
 # [auth[enthicated] {yes|no|on|off|any}]
 # allow [host|ip|*]
 # deny [host|ip]
 #
 # The regex syntax is the same as ruby ones.
 #
 # Ex:
 # path ~ .pp$
 # will match every resource ending in .pp (manifests files for instance)
 #
 # path ~ ^/path/to/resource
 # is essentially equivalent to path /path/to/resource
 #
 # environment:: restrict an ACL to a specific set of environments
 # method:: restrict an ACL to a specific set of methods
 # auth:: restrict an ACL to an authenticated or unauthenticated request
 # the default when unspecified is to restrict the ACL to authenticated requests
 # (ie exactly as if auth yes was present).
 #
 
 ### Authenticated ACL - those applies only when the client
 ### has a valid certificate and is thus authenticated
 
 # allow nodes to retrieve their own catalog (ie their configuration)
 path ~ ^/catalog/([^/]+)$
 method find
 allow $1
 
 # allow nodes to retrieve their own node definition
 path ~ ^/node/([^/]+)$
 method find
 allow $1
 
 # allow all nodes to access the certificates services
 path /certificate_revocation_list/ca
 method find
 allow *
 
 # allow all nodes to store their reports
 path /report
 method save
 allow *
 
 # inconditionnally allow access to all files services
 # which means in practice that fileserver.conf will
 # still be used
 path /file
 allow *
 
 ### Unauthenticated ACL, for clients for which the current master doesn't
 ### have a valid certificate
 
 # allow access to the master CA
 path /certificate/ca
-auth no
+auth any
 method find
 allow *
 
 path /certificate/
-auth no
+auth any
 method find
 allow *
 
 path /certificate_request
-auth no
+auth any
 method find, save
 allow *
 
 # this one is not stricly necessary, but it has the merit
 # to show the default policy which is deny everything else
 path /
 auth any
diff --git a/lib/puppet/network/rights.rb b/lib/puppet/network/rights.rb
index 6fde181c9..086ac74ed 100755
--- a/lib/puppet/network/rights.rb
+++ b/lib/puppet/network/rights.rb
@@ -1,276 +1,274 @@
 require 'puppet/network/authstore'
 require 'puppet/error'
 
 module Puppet::Network
 
 # this exception is thrown when a request is not authenticated
 class AuthorizationError < Puppet::Error; end
 
 # Define a set of rights and who has access to them.
 # There are two types of rights:
 #  * named rights (ie a common string)
 #  * path based rights (which are matched on a longest prefix basis)
 class Rights
 
   # We basically just proxy directly to our rights.  Each Right stores
   # its own auth abilities.
   [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
     define_method(method) do |name, *args|
       if obj = self[name]
         obj.send(method, *args)
       else
         raise ArgumentError, "Unknown right '#{name}'"
       end
     end
   end
 
   # Check that name is allowed or not
   def allowed?(name, *args)
     !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
   end
 
   def is_request_forbidden_and_why?(indirection, method, key, params)
     methods_to_check = if method == :head
                          # :head is ok if either :find or :save is ok.
                          [:find, :save]
                        else
                          [method]
                        end
     authorization_failure_exceptions = methods_to_check.map do |method|
       is_forbidden_and_why?("/#{indirection}/#{key}", params.merge({:method => method}))
     end
     if authorization_failure_exceptions.include? nil
       # One of the methods we checked is ok, therefore this request is ok.
       nil
     else
       # Just need to return any of the failure exceptions.
       authorization_failure_exceptions.first
     end
   end
 
   def is_forbidden_and_why?(name, args = {})
     res = :nomatch
     right = @rights.find do |acl|
       found = false
       # an acl can return :dunno, which means "I'm not qualified to answer your question,
       # please ask someone else". This is used when for instance an acl matches, but not for the
       # current rest method, where we might think some other acl might be more specific.
       if match = acl.match?(name)
         args[:match] = match
         if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
           # return early if we're allowed
           return nil if res
           # we matched, select this acl
           found = true
         end
       end
       found
     end
 
     # if we end here, then that means we either didn't match
     # or failed, in any case will throw an error to the outside world
     if name =~ /^\// or right
       # we're a patch ACL, let's fail
       msg = "#{(args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})")} access to #{name} [#{args[:method]}]"
 
       msg += " authenticated " if args[:authenticated]
 
       error = AuthorizationError.new("Forbidden request: #{msg}")
       if right
         error.file = right.file
         error.line = right.line
       end
     else
       # there were no rights allowing/denying name
       # if name is not a path, let's throw
       raise ArgumentError, "Unknown namespace right '#{name}'"
     end
     error
   end
 
   def initialize
     @rights = []
   end
 
   def [](name)
     @rights.find { |acl| acl == name }
   end
 
   def include?(name)
     @rights.include?(name)
   end
 
   def each
     @rights.each { |r| yield r.name,r }
   end
 
   # Define a new right to which access can be provided.
   def newright(name, line=nil, file=nil)
     add_right( Right.new(name, line, file) )
   end
 
   private
 
   def add_right(right)
     if right.acl_type == :name and include?(right.key)
       raise ArgumentError, "Right '%s' already exists"
     end
     @rights << right
     sort_rights
     right
   end
 
   def sort_rights
     @rights.sort!
   end
 
   # Retrieve a right by name.
   def right(name)
     self[name]
   end
 
   # A right.
   class Right < Puppet::Network::AuthStore
     include Puppet::FileCollection::Lookup
 
     attr_accessor :name, :key, :acl_type
     attr_accessor :methods, :environment, :authentication
 
     ALL = [:save, :destroy, :find, :search]
 
     Puppet::Util.logmethods(self, true)
 
     def initialize(name, line, file)
       @methods = []
       @environment = []
       @authentication = true # defaults to authenticated
       @name = name
       @line = line || 0
       @file = file
 
       case name
       when Symbol
         @acl_type = :name
         @key = name
       when /^\[(.+)\]$/
         @acl_type = :name
         @key = $1.intern if name.is_a?(String)
       when /^\//
         @acl_type = :regex
         @key = Regexp.new("^" + Regexp.escape(name))
         @methods = ALL
       when /^~/ # this is a regex
         @acl_type = :regex
         @name = name.gsub(/^~\s+/,'')
         @key = Regexp.new(@name)
         @methods = ALL
       else
         raise ArgumentError, "Unknown right type '#{name}'"
       end
       super()
     end
 
     def to_s
       "access[#{@name}]"
     end
 
     # There's no real check to do at this point
     def valid?
       true
     end
 
     def regex?
       acl_type == :regex
     end
 
     # does this right is allowed for this triplet?
     # if this right is too restrictive (ie we don't match this access method)
     # then return :dunno so that upper layers have a chance to try another right
     # tailored to the given method
     def allowed?(name, ip, args = {})
       return :dunno if acl_type == :regex and not @methods.include?(args[:method])
       return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
-      return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
+      return :dunno if acl_type == :regex and (@authentication and not args[:authenticated])
 
       begin
         # make sure any capture are replaced if needed
         interpolate(args[:match]) if acl_type == :regex and args[:match]
         res = super(name,ip)
       ensure
         reset_interpolation if acl_type == :regex
       end
       res
     end
 
     # restrict this right to some method only
     def restrict_method(m)
       m = m.intern if m.is_a?(String)
 
       raise ArgumentError, "'#{m}' is not an allowed value for method directive" unless ALL.include?(m)
 
       # if we were allowing all methods, then starts from scratch
       if @methods === ALL
         @methods = []
       end
 
       raise ArgumentError, "'#{m}' is already in the '#{name}' ACL" if @methods.include?(m)
 
       @methods << m
     end
 
     def restrict_environment(env)
       env = Puppet::Node::Environment.new(env)
       raise ArgumentError, "'#{env}' is already in the '#{name}' ACL" if @environment.include?(env)
 
       @environment << env
     end
 
     def restrict_authenticated(authentication)
       case authentication
       when "yes", "on", "true", true
         authentication = true
-      when "no", "off", "false", false
+      when "no", "off", "false", false, "all" ,"any", :all, :any
         authentication = false
-      when "all","any", :all, :any
-        authentication = nil
       else
         raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
       end
       @authentication = authentication
     end
 
     def match?(key)
       # if we are a namespace compare directly
       return self.key == namespace_to_key(key) if acl_type == :name
 
       # otherwise match with the regex
       self.key.match(key)
     end
 
     def namespace_to_key(key)
       key = key.intern if key.is_a?(String)
       key
     end
 
     # this is where all the magic happens.
     # we're sorting the rights array with this scheme:
     #  * namespace rights are all in front
     #  * regex path rights are then all queued in file order
     def <=>(rhs)
       # move namespace rights at front
       return self.acl_type == :name ? -1 : 1 if self.acl_type != rhs.acl_type
 
       # sort by creation order (ie first match appearing in the file will win)
       # that is don't sort, in which case the sort algorithm will order in the
       # natural array order (ie the creation order)
       0
     end
 
     def ==(name)
       return(acl_type == :name ? self.key == namespace_to_key(name) : self.name == name.gsub(/^~\s+/,''))
     end
 
   end
 
 end
 end
diff --git a/spec/unit/network/rights_spec.rb b/spec/unit/network/rights_spec.rb
index b709f10fa..30a4024fc 100755
--- a/spec/unit/network/rights_spec.rb
+++ b/spec/unit/network/rights_spec.rb
@@ -1,538 +1,529 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/network/rights'
 
 describe Puppet::Network::Rights do
   before do
     @right = Puppet::Network::Rights.new
   end
 
   describe "when validating a :head request" do
     [:find, :save].each do |allowed_method|
       it "should allow the request if only #{allowed_method} is allowed" do
         rights = Puppet::Network::Rights.new
         rights.newright("/")
         rights.allow("/", "*")
         rights.restrict_method("/", allowed_method)
         rights.restrict_authenticated("/", :any)
         rights.is_request_forbidden_and_why?(:indirection_name, :head, "key", {}).should == nil
       end
     end
 
     it "should disallow the request if neither :find nor :save is allowed" do
       rights = Puppet::Network::Rights.new
       why_forbidden = rights.is_request_forbidden_and_why?(:indirection_name, :head, "key", {})
       why_forbidden.should be_instance_of(Puppet::Network::AuthorizationError)
       why_forbidden.to_s.should == "Forbidden request:  access to /indirection_name/key [find]"
     end
   end
 
   [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |m|
     it "should have a #{m} method" do
       @right.should respond_to(m)
     end
 
     describe "when using #{m}" do
       it "should delegate to the correct acl" do
         acl = stub 'acl'
         @right.stubs(:[]).returns(acl)
 
         acl.expects(m).with("me")
 
         @right.send(m, 'thisacl', "me")
       end
     end
   end
 
   it "should throw an error if type can't be determined" do
     lambda { @right.newright("name") }.should raise_error
   end
 
   describe "when creating new namespace ACLs" do
 
     it "should throw an error if the ACL already exists" do
       @right.newright("[name]")
 
       lambda { @right.newright("[name]") }.should raise_error
     end
 
     it "should create a new ACL with the correct name" do
       @right.newright("[name]")
 
       @right["name"].key.should == :name
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("[name]")
 
       @right["name"].should be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when creating new path ACLs" do
     it "should not throw an error if the ACL already exists" do
       @right.newright("/name")
 
       lambda { @right.newright("/name")}.should_not raise_error
     end
 
     it "should throw an error if the acl uri path is not absolute" do
       lambda { @right.newright("name")}.should raise_error
     end
 
     it "should create a new ACL with the correct path" do
       @right.newright("/name")
 
       @right["/name"].should_not be_nil
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("/name")
 
       @right["/name"].should be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when creating new regex ACLs" do
     it "should not throw an error if the ACL already exists" do
       @right.newright("~ .rb$")
 
       lambda { @right.newright("~ .rb$")}.should_not raise_error
     end
 
     it "should create a new ACL with the correct regex" do
       @right.newright("~ .rb$")
 
       @right.include?(".rb$").should_not be_nil
     end
 
     it "should be able to lookup the regex" do
       @right.newright("~ .rb$")
 
       @right[".rb$"].should_not be_nil
     end
 
     it "should be able to lookup the regex by its full name" do
       @right.newright("~ .rb$")
 
       @right["~ .rb$"].should_not be_nil
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("~ .rb$").should be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when checking ACLs existence" do
     it "should return false if there are no matching rights" do
       @right.include?("name").should be_false
     end
 
     it "should return true if a namespace rights exist" do
       @right.newright("[name]")
 
       @right.include?("name").should be_true
     end
 
     it "should return false if no matching namespace rights exist" do
       @right.newright("[name]")
 
       @right.include?("notname").should be_false
     end
 
     it "should return true if a path right exists" do
       @right.newright("/name")
 
       @right.include?("/name").should be_true
     end
 
     it "should return false if no matching path rights exist" do
       @right.newright("/name")
 
       @right.include?("/differentname").should be_false
     end
 
     it "should return true if a regex right exists" do
       @right.newright("~ .rb$")
 
       @right.include?(".rb$").should be_true
     end
 
     it "should return false if no matching path rights exist" do
       @right.newright("~ .rb$")
 
       @right.include?(".pp$").should be_false
     end
   end
 
   describe "when checking if right is allowed" do
     before :each do
       @right.stubs(:right).returns(nil)
 
       @pathacl = stub 'pathacl', :acl_type => :regex, :"<=>" => 1, :line => 0, :file => 'dummy'
       Puppet::Network::Rights::Right.stubs(:new).returns(@pathacl)
     end
 
     it "should delegate to is_forbidden_and_why?" do
       @right.expects(:is_forbidden_and_why?).with("namespace", :node => "host.domain.com", :ip => "127.0.0.1").returns(nil)
 
       @right.allowed?("namespace", "host.domain.com", "127.0.0.1")
     end
 
     it "should return true if is_forbidden_and_why? returns nil" do
       @right.stubs(:is_forbidden_and_why?).returns(nil)
       @right.allowed?("namespace", :args).should be_true
     end
 
     it "should return false if is_forbidden_and_why? returns an AuthorizationError" do
       @right.stubs(:is_forbidden_and_why?).returns(Puppet::Network::AuthorizationError.new("forbidden"))
       @right.allowed?("namespace", :args1, :args2).should be_false
     end
 
     it "should first check namespace rights" do
       acl = stub 'acl', :acl_type => :name, :key => :namespace
       Puppet::Network::Rights::Right.stubs(:new).returns(acl)
 
       @right.newright("[namespace]")
       acl.expects(:match?).returns(true)
       acl.expects(:allowed?).with { |node,ip,h| node == "node" and ip == "ip" }.returns(true)
 
       @right.is_forbidden_and_why?("namespace", { :node => "node", :ip => "ip" } ).should == nil
     end
 
     it "should then check for path rights if no namespace match" do
       acl = stub 'nmacl', :acl_type => :name, :key => :namespace, :"<=>" => -1, :line => 0, :file => 'dummy'
       acl.stubs(:match?).returns(false)
       Puppet::Network::Rights::Right.stubs(:new).with("[namespace]").returns(acl)
 
       @right.newright("[namespace]")
       @right.newright("/path/to/there", 0, nil)
 
       @pathacl.stubs(:match?).returns(true)
 
       acl.expects(:allowed?).never
       @pathacl.expects(:allowed?).returns(true)
 
       @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
     end
 
     it "should pass the match? return to allowed?" do
       @right.newright("/path/to/there")
 
       @pathacl.expects(:match?).returns(:match)
       @pathacl.expects(:allowed?).with { |node,ip,h| h[:match] == :match }.returns(true)
 
       @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
     end
 
     describe "with namespace acls" do
       it "should return an ArgumentError if this namespace right doesn't exist" do
         lambda { @right.is_forbidden_and_why?("namespace") }.should raise_error(ArgumentError)
       end
     end
 
     describe "with path acls" do
       before :each do
         @long_acl = stub 'longpathacl', :name => "/path/to/there", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("/path/to/there", 0, nil).returns(@long_acl)
 
         @short_acl = stub 'shortpathacl', :name => "/path/to", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("/path/to", 0, nil).returns(@short_acl)
 
         @long_acl.stubs(:"<=>").with(@short_acl).returns(0)
         @short_acl.stubs(:"<=>").with(@long_acl).returns(0)
       end
 
       it "should select the first match" do
         @right.newright("/path/to/there", 0)
         @right.newright("/path/to", 0)
 
         @long_acl.stubs(:match?).returns(true)
         @short_acl.stubs(:match?).returns(true)
 
         @long_acl.expects(:allowed?).returns(true)
         @short_acl.expects(:allowed?).never
 
         @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should select the first match that doesn't return :dunno" do
         @right.newright("/path/to/there", 0, nil)
         @right.newright("/path/to", 0, nil)
 
         @long_acl.stubs(:match?).returns(true)
         @short_acl.stubs(:match?).returns(true)
 
         @long_acl.expects(:allowed?).returns(:dunno)
         @short_acl.expects(:allowed?).returns(true)
 
         @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should not select an ACL that doesn't match" do
         @right.newright("/path/to/there", 0)
         @right.newright("/path/to", 0)
 
         @long_acl.stubs(:match?).returns(false)
         @short_acl.stubs(:match?).returns(true)
 
         @long_acl.expects(:allowed?).never
         @short_acl.expects(:allowed?).returns(true)
 
         @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should not raise an AuthorizationError if allowed" do
         @right.newright("/path/to/there", 0)
 
         @long_acl.stubs(:match?).returns(true)
         @long_acl.stubs(:allowed?).returns(true)
 
         @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should raise an AuthorizationError if the match is denied" do
         @right.newright("/path/to/there", 0, nil)
 
         @long_acl.stubs(:match?).returns(true)
         @long_acl.stubs(:allowed?).returns(false)
 
         @right.is_forbidden_and_why?("/path/to/there", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
 
       it "should raise an AuthorizationError if no path match" do
         @right.is_forbidden_and_why?("/nomatch", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
     end
 
     describe "with regex acls" do
       before :each do
         @regex_acl1 = stub 'regex_acl1', :name => "/files/(.*)/myfile", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile", 0, nil).returns(@regex_acl1)
 
         @regex_acl2 = stub 'regex_acl2', :name => "/files/(.*)/myfile/", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile/", 0, nil).returns(@regex_acl2)
 
         @regex_acl1.stubs(:"<=>").with(@regex_acl2).returns(0)
         @regex_acl2.stubs(:"<=>").with(@regex_acl1).returns(0)
       end
 
       it "should select the first match" do
         @right.newright("~ /files/(.*)/myfile", 0)
         @right.newright("~ /files/(.*)/myfile/", 0)
 
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl2.stubs(:match?).returns(true)
 
         @regex_acl1.expects(:allowed?).returns(true)
         @regex_acl2.expects(:allowed?).never
 
         @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should select the first match that doesn't return :dunno" do
         @right.newright("~ /files/(.*)/myfile", 0)
         @right.newright("~ /files/(.*)/myfile/", 0)
 
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl2.stubs(:match?).returns(true)
 
         @regex_acl1.expects(:allowed?).returns(:dunno)
         @regex_acl2.expects(:allowed?).returns(true)
 
         @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should not select an ACL that doesn't match" do
         @right.newright("~ /files/(.*)/myfile", 0)
         @right.newright("~ /files/(.*)/myfile/", 0)
 
         @regex_acl1.stubs(:match?).returns(false)
         @regex_acl2.stubs(:match?).returns(true)
 
         @regex_acl1.expects(:allowed?).never
         @regex_acl2.expects(:allowed?).returns(true)
 
         @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should not raise an AuthorizationError if allowed" do
         @right.newright("~ /files/(.*)/myfile", 0)
 
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl1.stubs(:allowed?).returns(true)
 
         @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should raise an error if no regex acl match" do
         @right.is_forbidden_and_why?("/path", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
 
       it "should raise an AuthorizedError on deny" do
         @right.is_forbidden_and_why?("/path", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
 
     end
   end
 
   describe Puppet::Network::Rights::Right do
     before :each do
       @acl = Puppet::Network::Rights::Right.new("/path",0, nil)
     end
 
     describe "with path" do
       it "should say it's a regex ACL" do
         @acl.acl_type.should == :regex
       end
 
       it "should match up to its path length" do
         @acl.match?("/path/that/works").should_not be_nil
       end
 
       it "should match up to its path length" do
         @acl.match?("/paththatalsoworks").should_not be_nil
       end
 
       it "should return nil if no match" do
         @acl.match?("/notpath").should be_nil
       end
     end
 
     describe "with regex" do
       before :each do
         @acl = Puppet::Network::Rights::Right.new("~ .rb$",0, nil)
       end
 
       it "should say it's a regex ACL" do
         @acl.acl_type.should == :regex
       end
 
       it "should match as a regex" do
         @acl.match?("this should work.rb").should_not be_nil
       end
 
       it "should return nil if no match" do
         @acl.match?("do not match").should be_nil
       end
     end
 
     it "should allow all rest methods by default" do
       @acl.methods.should == Puppet::Network::Rights::Right::ALL
     end
 
     it "should allow only authenticated request by default" do
       @acl.authentication.should be_true
     end
 
     it "should allow modification of the methods filters" do
       @acl.restrict_method(:save)
 
       @acl.methods.should == [:save]
     end
 
     it "should stack methods filters" do
       @acl.restrict_method(:save)
       @acl.restrict_method(:destroy)
 
       @acl.methods.should == [:save, :destroy]
     end
 
     it "should raise an error if the method is already filtered" do
       @acl.restrict_method(:save)
 
       lambda { @acl.restrict_method(:save) }.should raise_error
     end
 
     it "should allow setting an environment filters" do
       Puppet::Node::Environment.stubs(:new).with(:environment).returns(:env)
 
       @acl.restrict_environment(:environment)
 
       @acl.environment.should == [:env]
     end
 
     ["on", "yes", "true", true].each do |auth|
       it "should allow filtering on authenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
 
         @acl.authentication.should be_true
       end
     end
 
-    ["off", "no", "false", false].each do |auth|
-      it "should allow filtering on unauthenticated requests with '#{auth}'" do
+    ["off", "no", "false", false, "all", "any", :all, :any].each do |auth|
+      it "should allow filtering on authenticated or unauthenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
-
         @acl.authentication.should be_false
       end
     end
 
-    ["all", "any", :all, :any].each do |auth|
-      it "should not use request authenticated state filtering with '#{auth}'" do
-        @acl.restrict_authenticated(auth)
-
-        @acl.authentication.should be_nil
-      end
-    end
-
     describe "when checking right authorization" do
       it "should return :dunno if this right is not restricted to the given method" do
         @acl.restrict_method(:destroy)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save } ).should == :dunno
       end
 
       it "should return allow/deny if this right is restricted to the given method" do
         @acl.restrict_method(:save)
         @acl.allow("127.0.0.1")
 
         @acl.allowed?("me","127.0.0.1", { :method => :save }).should be_true
       end
 
       it "should return :dunno if this right is not restricted to the given environment" do
         Puppet::Node::Environment.stubs(:new).returns(:production)
 
         @acl.restrict_environment(:production)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :environment => :development }).should == :dunno
       end
 
       it "should return :dunno if this right is not restricted to the given request authentication state" do
         @acl.restrict_authenticated(true)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :authenticated => false }).should == :dunno
       end
 
       it "should return allow/deny if this right is restricted to the given request authentication state" do
         @acl.restrict_authenticated(false)
         @acl.allow("127.0.0.1")
 
         @acl.allowed?("me","127.0.0.1", { :authenticated => false }).should be_true
       end
 
       it "should interpolate allow/deny patterns with the given match" do
         @acl.expects(:interpolate).with(:match)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
       end
 
       it "should reset interpolation after the match" do
         @acl.expects(:reset_interpolation)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
       end
 
       # mocha doesn't allow testing super...
       # it "should delegate to the AuthStore for the result" do
       #     @acl.method(:save)
       #
       #     @acl.expects(:allowed?).with("me","127.0.0.1")
       #
       #     @acl.allowed?("me","127.0.0.1", :save)
       # end
     end
   end
 
 end