When I issue the command
# pfctl -a authpf -s r
I just get the prompt back whether my testuser is logged on or not.
Starting with 3.6, authpf creates an anchor inside the 'authpf' anchor
for each user that authenticates successfully. In other words, the
'authpf' anchor does not contain any rules, only more anchors. This is
explained here: