With Authentication=None in the Default Web Site's web.config it's possible to access the main folder of a web app:
wwwroot
web.config
fooFolder
someFile.aspx
StylesFolder
fooStyles.css
A browser over the internet can open someFile.aspx. However the fooStyles.css file is inaccessible. 401.
I've set the AppPool for the foo webapp to ASP.NET v4.0 and have granted the IIS AppPool\ASP.NET v4.0 identity read+execute on the fooFolder folder and on the subfolders beneath it, including the StyleFolder. I've double, triple, quadruple checked the ACL.
With authentication=Windows the remote browser is completed unable to do anything with the app, and is denied access to someFile.aspx.