--- a/dbapi.py	Wed Dec 04 19:11:04 2013 +0100
+++ b/dbapi.py	Tue Nov 12 17:10:16 2013 +0100
@@ -270,7 +270,7 @@
     raises an AuthenticationError if anonymous usage is not allowed
     """
     anoninfo = vreg.config.anonymous_user()
-    if anoninfo is None: # no anonymous user
+    if anoninfo[0] is None: # no anonymous user
         raise AuthenticationError('anonymous access is not authorized')
     anon_login, anon_password = anoninfo
     # use vreg's repository cache

--- a/web/application.py	Wed Dec 04 19:11:04 2013 +0100
+++ b/web/application.py	Tue Nov 12 17:10:16 2013 +0100
@@ -65,7 +65,7 @@
         self.session_time = vreg.config['http-session-time'] or None
         self.authmanager = vreg['components'].select('authmanager', vreg=vreg)
         interval = (self.session_time or 0) / 2.
-        if vreg.config.anonymous_user() is not None:
+        if vreg.config.anonymous_user()[0] is not None:
             self.cleanup_anon_session_time = vreg.config['cleanup-anonymous-session-time'] or 5 * 60
             assert self.cleanup_anon_session_time > 0
             if self.session_time is not None: