I am working on a new module which uses Web API in DNN 7.2.1

By default when setting up DNN, the following are the default (and most secure) settings for password storage:

passwordFormat = Hashed

enablePasswordRetrieval = false

Now, I have created a Web API method which is decorated with [AllowAnonymous]

When I attempt to test the REST API for that method (while NOT logged into DNN), I get an HTTP 500 "Password retrieval is not enabled".

Can someone help explain why this is happening?  The user is NOT logged in, and is attempting to call a Web API which allows anonymous browsing....