My code runs fine in visualforce but when I publish to site it gives me an error indicating that the api is disabled for a particular user.

Coincidentally, there isn't any custom code here - it's taken directly from the example in the ajax toolkit developer's guide:

<apex:page >
    <script type="text/javascript">
    var __sfdcSessionId = '{!GETSESSIONID()}';
    </script>
    <script src="../../soap/ajax/21.0/connection.js"
          type="text/javascript"></script>
    <script type="text/javascript">     window.onload = setupPage;
    function setupPage() {
      //function contains all code to execute after page is rendered  
    

      var state = { //state that you need when the callback is called  
    
          output : document.getElementById("output"),
          startTime : new Date().getTime()};

      var callback = {
          //call layoutResult if the request is successful  
    
          onSuccess: layoutResults,

          //call queryFailed if the api request fails  
    
          onFailure: queryFailed,
          source: state};

      sforce.connection.query(
          "Select Id, Name, Industry From Account order by Industry",
           callback);
  }

  function queryFailed(error, source) {
    source.output.innerHTML = "An error has occurred: " + error;
  }

  /**
  * This method will be called when the toolkit receives a successful
  * response from the server.
  * @queryResult - result that server returned
  * @source - state passed into the query method call.
  */  
    
  function layoutResults(queryResult, source) {
    if (queryResult.size > 0) {
      var output = "";

      //get the records array  
    
      var records = queryResult.getArray('records');

      //loop through the records and construct html string  
    
      for (var i = 0; i < records.length; i++) {
        var account = records[i];

        output += account.Id + " " + account.Name +
            " [Industry - " + account.Industry + "]<br>";
      }

    //render the generated html string  
    
    source.output.innerHTML = output;
    }
  }
  </script>

    <div id="output"> </div>
   
</apex:page>

So my questions are:

can the ajax toolkit be enabled on force.com sites for an anonymous, read only user?

if so, how? 

if not, is there a workaround?