If you do not allow anonymous access to files served up in the html directory, you will need to add this line to your notes.ini file.
NoWebFileSystemACLs=1 allows anonymous access to files in the HTML directory.