Support `anyone` can `query` in protocols

[thehenrytsai]

Needs further discussion including if anyone means unauthenticated/unsigned queries, because current code path for unauthenticated query is to return only published records.

Related to #285.