I've gotten something like this to work in ACS a couple years back using ActiveSync, but I don't remember if there was any login magic that needed to happen.
Are you creating Channel Definition (.cdf) files? Or are you somehow just pointing to the login URL and spidering the site?
If you're going the CDF route (which worked for me), can you create a CDF file that references non-permissioned resources and sync that down to the PDA? In other words, can you get a simple web page or even an image that doesn't require permission to sync to your PDA?
It'd be good to figure out whether it's a permission or a sync config issue.
