In the ACS world, there are two different authentication pieces. One for ACS → CPE, and one for CPE → ACS.
By default, GenieACS handles setting up the CPE → ACS authentication. Does your CPE require authentication for the ACS to connect to the connection request URL? If so, then you need to set the cwmp.connectionRequestAuth config value with something like this:
AUTH(username, password) OR AUTH("myUsername1", "myPassword1") OR AUTH("myUsername2", "myPassword2")