This appears to be undocumented. By default, IIS7 uses kernel-mode authentication, which happens to have a large performance benefit. There is a bug in kernel-mode authentication where requests that send credentials will fail unless an anonymous request
