See this relevant discussion:
@Alan_G explains that any unauthenticated access scope should allow cart attributes to be modified.