Let's see your web permissions config?
I think I have it setup so that anyone can view maps, status, player locations, etc, but not the log.
<?xml version="1.0" encoding="UTF-8"?>
<webpermissions>
<admintokens>
<!-- <token name="adminuser1" token="supersecrettoken" permission_level="0" /> -->
</admintokens>
<permissions>
<!-- <permission module="webapi.executeconsolecommand" permission_level="0" /> -->
<!-- <permission module="webapi.getplayersonline" permission_level="1" /> -->
<!-- <permission module="web.map" permission_level="1000" /> -->
<permission module="web.map" permission_level="2000" />
<permission module="webapi.getstats" permission_level="2000" />
<permission module="webapi.getplayerslocation" permission_level="2000" />
<permission module="webapi.getlandclaims" permission_level="1000" />
<permission module="webapi.getlog" permission_level="0" />
<permission module="webapi.getplayersonline" permission_level="2000" />
<permission module="webapi.getplayerinventory" permission_level="2000" />
</permissions>
</webpermissions>