Currently, the classification code in the REST gateway does not correctly handle the case where there is no valid token, but we still got trust level C. This causes the request to be classified as "anon", even though it has a compliant User-Agent header (and x-ua-contact). In theory, trsut level C should only be assigned if there is a valid token, but apparently the checks in Envoy are more strict than the ones in haproxy. I suspect this happens for requests that have a properly signed but expired token.

The REST gateway should treat requests without a valid token but with trust level C and a x-us-contact header as if it had trust level D.