Meanwhile, the way the PHP plugin works is as follows.
1. In the manifest file, you can control what level of authentication is allowed to call into the PHP app.
<Authentication>AUTH_ROLE_OWNER</Authentication>
AUTH_ROLE_OWNER, or AUTH_ROLE_GUEST or AUTH_ROLE_ANONYMOUS
If the call does not have the right level the call will fail.
2. There are two Tonido specific env variables which show what the auth levels are, which are passed into PHP.
TONIDO_AUTH_ROLE, TONIDO_AUTH_USER
The AUTH_ROLE variable will have either OWNER, GUEST or ANONYMOUS.
If it is owner
the AUTH_USER variable be empty.
If it is guest
the AUTH_USER variable be set to the name of the guest.
If it is anonymous
the AUTH_USER variable be empty.
Based on this you can figure out how you want to setup your guest access. You can set ANONYMOUS in manifest and handle your own authentication. If not, you can use Tonido's authentication.
Hope this helps.