What I found out was that if you have a portlet that changes window state or needs to pass information from any method (in any scope: Application or Portlet) to a
JSP file, state is not persisted in "authlessanonymous" mode, meaning, nobody is logged in.
Once the user logs in, the portlet works as coded.
This is kind of strange since Pluto doesn't ask you to login and the portlet works, so it must maintain session and implement a default login.