It could be a side effect of following:
createShoppingListItem logically doesn't require a login but it then checks for checkShoppingListItemSecurity and here it falls out because of the security.
I see 2 problem :
1) createShoppingListitem if can be accessed without login then it should not check for security later on.
2) While adding a new item to shopping cart, setQuantity method of ShoppingCartItem calls ShoppingListEvents.fillAutoSaveList(cart, dispatcher); IMHO it should only be called if user is logged in.