And to ad to Tobias' comment, even if the service isn't secure, if the folder (or root directory) it is in within ArcGIS is secure, you would have to log in to see the folder too.
and just in case.....the service of course needs to be running. REST directory sill not show stopped services, but AGS Manager and viewing thru Catalog will, since you can start/stop/etc in either of those.