Hello James
I had the exact requirement and I have tried anonymous connection to my database and no authentication in destinations which works for me. The only difference from your scenario is I am using a productive account.
The initial authentication to the application is for SCN authentication. If you want to avoid that please follow the below link and make changes in neo-app.json
After that I have put anonymous connection to the XS package which should expose all the resources.
I would ask one more thing - please check your HTML application dashboard which should show your internal destination as green (connected).
Regards
Vivek