Is there any rule that says when SOAPAction is REQUIRED in the setRequestHeader?
In my jQuery library (SPServices), I've been including the SOAPAction for every Web Service call. It turns out that is what is preventing anonymous access to the Web Services to work. When I remove SOAPAction entirely and I AM logged in, some calls fail with the following error:
errorstring: The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again. errorcode: 0x8102006d
I suppose that it could be as simple as operations which read vs. operations which write, but I figured I'd toss it out there for ideas.
UPDATE: @cwheeler76 pointed out this article from Jan Tielens: The security validation for this page is invalid" when calling the SharePoint Web Services. It also describes the problem and the solution using SOAPAction. I'm looking for more the 'when' as opposed to the 'how'.