If users are individually identified in any way at all then a Windows Server CAL is required. Individually identified is not restricted to Windows Server authentication. If a user is individually identified through any means at all then a Windows Server CAL is required. The term "or through any other means" was added to the licence terms for Windows Server when Microsoft launched the R2 version of Windows Server 2003 and these terms were intended to clarify the fact that individually identified does not relate only to Windows Server authentication.
Microsoft makes available a licence called a Windows Server External Connector licence. The Windows Server External Connector licence permits an unlimited number of non-employees to access the Windows Server without needing a CAL.
If your server environment is open to the general public you have no other option than to acquire a Windows Server External Connector Licence as it is not possible to acquire a CAL for each potential person in the world who could access your server. If you have restricted access to your server to a specific group of users then you should determine the breakeven price point between acquiring CALs instead of a Windows Server External Connector Licence.
Please note, if you decide to acquire a Windows Server External Connector licence instead of CALs you will need one for each physical server that forms part of your web solution. i.e if you have multiple physical servers that make up the solution then each physical server will require one of these licenses.
You should also be aware that the Web Edition operating system is typically cheaper than the Standard Edition operating system and you do not require CALs or an External Connector Licence to allow users to access it. There are however technical differences between the two operating systems and some other licensing restrictions that may make Standard Edition the only viable option but it can be worth looking into.