The docs say you can use Basic authentication, but only with SSL, or you can use Digest or Windows authentication. I have a requirement to use no authentication at all. We have a particular vendor that we integrate with that doesn't integrate with IIS's authentication schemes and/or SSL, so we're kind of in a spot right now.