Authentication fails for anonymous users

Currently when an anonymous user clicks on the modal link nothing happens and "access denied" is reported in the log.

This is due to the _csfr_token check failing for users without an active session. The solution for now is to remove that access check as the route also uses _custom_access.

See: #2730351: CSRF check always fails for users without a session