Transition.py: a more robust guard which avoid anonymous user doing whatever in URL. Now if guard is None, getGuard will give all roles except Anonymous to guard.