All the stuff that is done by the Apache Server needs to be done manually, I can only assume it has been set this way because you can't use the OSX secure identification and so they are not going to do it for you. The OSX help doesn't tell you straight but once you dig-in deeper into how to make WebDAV actually work it becomes obvious what is going on.
To the point: You have to set the authentication to basic.
The directory where all the config files are is:
/Library/Server/Web/Config/apache2/
the one you are looking for is:
httpd_server_app.conf
the line that would need uncommenting is
#LoadModule auth_basic_module libexec/apache2/mod_auth_basic.so
This is how you make it principally work. You should then enable SSL but I don't want to give any security advice because I don't know anything about setting up webservers. I simply was also fooled into buying the Server.app and spent a whole weekend getting to the point where I understood that the Server.app actually doesn't do what it suggests.
Important: If you enable a User that has a User folder on the Mac running the Server.app the this folder will get automatically shared and will be accessible using the log-in credentials. It is not possible to turn this behaviour off. I have the suspicion that this might be reason why enabling any form of Websharing requires extra user effort. Not sharing a Users home folder to the User himself can't be disabled for smb/afp either so it might be deep in OSX somewhere. Anyway, a Users homefolder gies Access to the ~/Library folder. This leads to the possibility of starting a LaunchAgent. Since the User starting this Launch Agent probably possesses Administrator rights and is able to sudo such a Launch Agent could do anything anywhere on the system, maybe the network.