Custom actions fail when anonymous
To get the form definition of a portal action involves to get "put action" in the "_actions" field, which is forbidden for anonymous user. See: https://lab.nexedi.com/nexedi/erp5/blob/master/bt5/erp5_hal_json_style/SkinTemplateItem/portal_skins/erp5_hal_json_style/ERP5Document_getHateoas.py#L855-862
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information