How to Configure Security for Pi Web API?

I'm looking for information on configuring security for the Pi Web API.

I have the API installed and can get asset servers and databases to list by leaving prompting username / password blank.   However, once I try to retrieve elements, I run into the following error:

{
"Errors": [
"The Windows identity 'NT AUTHORITY\\ANONYMOUS LOGON' associated with the request cannot be impersonated."
]
}

I have tried logging in at the prompt with a user with full permissions on the pi server and af server, but it doesn't appear to accept those credentials.

Any pointers or documentation would be greatly appreciated.

Thanks,

Chris