Some of these were using 660 permissions which meant that other users in the "users" group could connect to anon's service processes. Let's tighten things up by not allowing that. :^)