Comment by SilasX

Semi-related: there was some quirk with Amazon S3 where you could designate a resource as open to the world, but it would still reject anyone that submitted (unnecessary) authentication credentials as part of the request.