In 0.8.2, despite removing the permission
db.security.addPermissionToRole('Anonymous', 'Email
Access')
it is possible for the anonymous user to access the
tracker, if the Create User permission is not removed
(and removing it prevents registration via the web
interface); see 
http://thread.gmane.org/gmane.comp.bug-tracking.roundup.user/5194

The attached patch seems to fix this.