Security settings for this service require 'Anonymous' Authentication but it is not enabled for the IIS application that hosts this service.
There is no way I can have anonymous access enabled in IIS so what do you do?
Short answer: don't use mexHttpsBinding (or mexHttpBinding for that matter).
I've already got a wsHttpBinding and associated binding configuration, so I've just modified the existing mex endpoint.
From:
<endpoint address="mex" binding="mexHttpsBinding" name="mexHttps"
contract="IMetadataExchange" />
To:
<endpoint address="mex" binding="wsHttpBinding" bindingConfiguration="wsSecureBinding" name="mexHttps" contract="IMetadataExchange" />
This assumes you already have a bindingConfiguration called wsSecureBinding.