I've been using Redmine.pm to control access to other per-project resources that aren't really repositories, such as WebDAV storage areas. One of these WebDAV areas hosted an Eclipse repository in a public project, and it was asking for a password simply to install artifacts from it from Eclipse.

After looking at the logs, it appears that Eclipse was checking if a certain file existed using the HTTP HEAD method. As it's not considered read-only by Redmine.pm, it was asking for auth credentials. IIRC, HTTP HEAD is a read-only method, as it is basically a GET request without the body:

http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.4

I've attached a trivial patch that fixes the problem by adding HEAD as a read-only method. With this, the hosted update site can be installed from Eclipse just fine.