As far as I know nothing has changed for that part of the authentication. I have several v7 sites and v9 sites running without issue using anonymous authentication disabled. You might compare the your IIS websites and see what is different if you have them running in different websites. Guessing there is some configuration which is incomplete or incorrect.