Securing Web Services with Session Authentication or Anonymous Read Access

I seem to have two scenarios where securing a web service does not function.

Using session authentication or if the anonymous user has any access to the database.

Has anyone been able to get web services to work with either of these two scenarios?

Other than that, I am able to supply credentials and preauthenticate using a .NET web reference and it seems to work fine.

Thank you,

Rich