The "Authenticated" function in line 34 of saci.lua is currently defined as:

Authenticated = function(user)   return user ~= nil and user:len() > 0 end,

However, an anonymous user can be represented as user == false, which will cause user:len() to produce an error, and cause permissions checking to stop at that point.

This can be fixed by defining the function as:

Authenticated = function(user)   return user and user:len() > 0