The annotation value require-whisk-auth: false on a web action leads the controller to reject the web action invocation.

1. The openwhisk documentation does not say what should happen when the value is false. I don't know why this case is omitted case https://github.com/apache/openwhisk/blob/master/docs/webactions.md#securing-web-actions
2. The implementation treats this case as "not allowed, something is not right" see line 790 in this snippet
   

   openwhisk/core/controller/src/main/scala/org/apache/openwhisk/core/controller/WebActions.scala

   Lines 777 to 790 in d9e908c

   	private def confirmAuthenticated(annotations: Parameters,
   	reqHeaders: Seq[HttpHeader],
   	authenticatedUser: Option[Identity]): Option[Boolean] = {
   	def checkAuthHeader(expected: String): Boolean = {
   	reqHeaders.find(_.is(WhiskAction.requireWhiskAuthHeader)).map(_.value == expected).getOrElse(false)
   	}
   	annotations
   	.get(Annotations.RequireWhiskAuthAnnotation)
   	.map {
   	case JsString(auth) => checkAuthHeader(auth) // allowed if auth matches header
   	case JsNumber(auth) => checkAuthHeader(auth.toString) // allowed if auth matches header
   	case JsTrue | JsBoolean(true) => authenticatedUser.isDefined // allowed if user already authenticated
   	case _ => false // not allowed, something is not right

The controller should handle the case of the annotation being set to boolean false as not requiring authentication rather than reject the call.