He's not bypassing registration. Guest are registered in a table when thet attempt to access a place by a link. This is because we should register any attempts. You can simply attempt to access the place by the same link as guest and you'll see that you are being redirected to "forbidden" page or to login page. "Guest" is the same user for YAF with the security check viewpoint.