After setting auth_allow_localhost to true, create/update/register/delete commands fail with 500 error

After enabling the localhost to bypass authentication (auth_allow_localhost: true in config-defaults.yaml), we found that from the razor server read-only commands worked (i.e., razor nodes), but create/update/register/delete commands no longer worked. We would get a 500 error as follows:

from /var/log/puppetlabs/razor-server/server.log:

15:35:35,274 INFO [razor.web.log] (http-/0.0.0.0:8151-3) 127.0.0.1 - - [03/Feb/2017:15:35:35 -0600] "GET /api " 200 6629 0.0120
15:35:35,356 INFO [razor.web.log] (http-/0.0.0.0:8151-3) 127.0.0.1 - - [03/Feb/2017:15:35:35 -0600] "GET /api/commands/register-node " 200 6205 0.0140
15:35:35,419 INFO [razor.web.api] (http-/0.0.0.0:8151-2) 2017-02-03 15:35:35 - Java::OrgApacheShiroAuthz::UnauthenticatedException - This subject is anonymous - it does not have any identifying principals and authorization operations require an identity to check against. A Subject instance will acquire these identifying principals automatically after a successful login is performed be executing org.apache.shiro.subject.Subject.login(AuthenticationToken) or when 'Remember Me' functionality is enabled by the SecurityManager. This exception can also occur when a previously logged-in Subject has logged out which makes it anonymous again. Because an identity is currently not known due to any of these conditions, authorization is denied.:
org.apache.shiro.subject.support.DelegatingSubject.assertAuthzCheckPossible(org/apache/shiro/subject/support/DelegatingSubject.java:199)
org.apache.shiro.subject.support.DelegatingSubject.checkPermissions(org/apache/shiro/subject/support/DelegatingSubject.java:214)
....
java.lang.Thread.run(java/lang/Thread.java:745)
15:35:35,422 INFO [razor.web.log] (http-/0.0.0.0:8151-2) 127.0.0.1 - - [03/Feb/2017:15:35:35 -0600] "POST /api/commands/register-node " 500 30 0.0130

We are running these commands from the localhost (razor server itself) and without passing any credentials. If we pass credentials, all commands work as expected. We were hoping to take advantage of the auth_allow_localhost feature and not have to store razor creds in an environment variable or a bash profile.

I had originally posted about this on the puppet-razor google group: https://groups.google.com/forum/#!topic/puppet-razor/2dmxYU0xEq0

(I will create a feature request in a separate ticket regarding the CLI and how it handles authentication; would like to suggest something.)