why can anonymous edit pages and admin blocks?

I have had this for some time now as i was developing a new site... but getting close to release so need to get it sorted out.

was using a post-beta 4.7 cvs build at the time (but have now upgraded to 4.7beta5 and no help).

i have 2 test links which show in my secondary links (doubt this is a clue; but thought i'd mention it)

- admin/block/configure/block/3

- node/43/edit

both of these are accessible as anonymous

other blocks and nodes are not accessible - which makes sense since only access setting for anon is "access content"

for the config/block all i see is the ability to adjust visibilty

for the node/edit - it is a php page and anon has full access to php code - HOWEVER; the input format is limited to html - so i guess it is likely ok for me to point to the site - since i doubt bad php code can be saved.

just wondering if anyone has seen this before???