Alright, I've checked the following:
The HTML file does not have to have .htm or .html at the end, you can remove it and it'll still work and process Lua correctly.
You can grant public access to a HTTP resource, by adding the following right in the Default ACL: resource.(resourcename).http (this is an ACL right, not an object of an ACL group)
However, I would still advise you to just add an account for "remote", place it within an elevated ACL group, for example, RPC (or your own ACL group) and add the aforementioned right only to that ACL instead of making it public. Then just connect to the HTTP as follows: http://remote:(remoteaccountpassword)@(serverip):(serverhttpport)/(resourcename)/call?do=(whatever)