In the current (5.0) REST implementation, it is by default not allowed to query the API as anonymous user, since it expects by default basic authentication.

If you want to allow anonymous REST calls, disabled in app/config/security.yml so that the system falls back to session authentication.

Multiple authentication methods should be allowed at the same time.