Document that Anonymous Access policy should be placed before APIcast

As the title says, the Anonymous Access policy only works if it is placed before APIcast.

This should be reflected in:

• the policy description
• the documentation