diff --git a/radicale/__init__.py b/radicale/__init__.py
index d2ca309..92a4ea3 100644
--- a/radicale/__init__.py
+++ b/radicale/__init__.py
@@ -278,30 +278,21 @@ class Application(object):
         else:
             user = password = None
 
-        if not items or function == self.options or \
-                auth.is_authenticated(user, password) if user else True:
+        read_allowed_items, write_allowed_items = \
+            self.collect_allowed_items(items, user)
 
-            read_allowed_items, write_allowed_items = \
-                self.collect_allowed_items(items, user)
-
-            if read_allowed_items or write_allowed_items or \
-                    function == self.options or not items:
-                # Collections found, or OPTIONS request, or no items at all
-                status, headers, answer = function(
-                    environ, read_allowed_items, write_allowed_items, content,
-                    user)
-            elif not user:
-                # Unknown or unauthorized user
-                log.LOGGER.info("%s refused" % (user or "Anonymous user"))
-                status = client.UNAUTHORIZED
-                headers = {
-                    "WWW-Authenticate":
-                    "Basic realm=\"%s\"" % config.get("server", "realm")}
-                answer = None
-            else:
-                # Good user but has no rights to any of the given collections
-                status, headers, answer = NOT_ALLOWED
+        if ((read_allowed_items or write_allowed_items)
+            and auth.is_authenticated(user, password)) or \
+                function == self.options or not items:
+            # Collections found, or OPTIONS request, or no items at all
+            status, headers, answer = function(
+                environ, read_allowed_items, write_allowed_items, content,
+                user)
         else:
+            status, headers, answer = NOT_ALLOWED
+
+        if (status, headers, answer) == NOT_ALLOWED and \
+                not auth.is_authenticated(user, password):
             # Unknown or unauthorized user
             log.LOGGER.info("%s refused" % (user or "Anonymous user"))
             status = client.UNAUTHORIZED
diff --git a/radicale/rights.py b/radicale/rights.py
index e43c6dd..7f741a1 100644
--- a/radicale/rights.py
+++ b/radicale/rights.py
@@ -91,9 +91,10 @@ def _read_from_sections(user, collection, permission):
 
 
 def authorized(user, collection, right):
-    """Check if the user is allowed to read or write the collection."""
+    """Check if the user is allowed to read or write the collection.
+
+       If the user is empty it checks for anonymous rights
+    """
     rights_type = config.get("rights", "type").lower()
-    return rights_type == "none" or (
-        (True if not user else user) and _read_from_sections(
-            user if user else "", collection.url.rstrip("/") or "/", right)
-    )
+    return rights_type == "none" or (_read_from_sections(
+        user or "", collection.url.rstrip("/") or "/", right))