I think this comes down to the problem in IIS 5.0 that when you are running the "application" in pooled or isolated mode, it runs ISAPI dlls (like ssinc.dll) as IWAM_ by default. Even though IIS used the "Anonymous account",(or the account selected by challenge/response or basic auth), to verify the ACLs on the .html file, ssinc.dll will run with the SID of IWAM_. So if the .html file or the include file is not accessable by this account, you get these errors.
Try ensuring that the IWAM account has access to the necessary files, or change the default "WAM" account using metaedit.