title: Which IIS Authentication to use for Token authentication Web Api REST service
body: <p>I am playing with Asp.Net Web Api 2 creating a REST service with token authentication (under normal IIS 7.5, not express). Therefore, I've used the standard generated template that comes with Visual Studio 2015.</p>
  
  <p>I understand the concept and the code too, did some testing wth Fiddler, getting the token, try to register etc. and I like the approach.
  But there's 1 thing I don't understand and I miss that in about every article I've read about it: 
  what should be the IIS authentication setting(s) for the service?
  By default, anonymous authentication is turned on and the other options 
  (forms, windows, basic) off.
  If I understood correctly it shouldn't matter (because the OAuth Authorization Server and OWIN in the WebApi service should take over the complete authentication mechanism for the service, right?), or else all IIS authentication options should be turned off.</p>
  
  <p>But I see that it does matter. Because if I want to execute a '/api/Register' POST method, it only works if I have anonymous authentication turned ON. If I turn it off, I get a 401.2 Unauthorized result.
  But it seems so unlogic / unsafe to me to keep the anonymous authentication turned ON. I'd like to turn that off. Or do I have to have it turned on? And if so, why? Am I missing something?</p>
  
  <p>I've also set the authentication method in my web.config to 'None': 
  (Only thing I changed in my web.config is the database connectionstring.)</p>