The scripted rest api will be run under which credential?

Will it be run under the system credential or caller credential? Or both are possible depends on the settings? what to indicate the settings? 

What's the difference when I check the "requires authentication" "requires ACL authorization" in the scripted rest resource? 

Thanks.