Gadgets use the UserProvider.getUser() to access preferences instead of getting from WebConstants.FO_LOGIN.
When I'm not logged on the Front-Office, UserProvider.getUser() returns "admin", so every anonymous see and can modify the same "admin's" gadgets.