Ok, this is well outside my comfort zone as I've never worked with this kind of web service... but having just created one in D2009 (I haven't run it, just created the project), I have a few observations.

In the created one (with example methods), all methods use STDCALL;, both on the interface in the class definition AND in the actual implementation too.
All the parameters in the example are passed in as CONST.

So in WebServerIntf.pas you have:-

Code:
IWebServer = interface(IInvokable)
....
  function Login(AUserName, APassword: string) : Tcustomer; stdcall;
....
end;
Change the parameters to:-

Code:
IWebServer = interface(IInvokable)
....
  function Login(const AUserName:string;const APassword: string) : Tcustomer; stdcall;
....
end;
The same applies to all of them.

And in WebServerImpl.pas change the interface to have:-

Code:
function Login(const AUserName:string;const APassword: string) : Tcustomer; stdcall;
Change the parameters and add STDCALL to the implementation:-

Code:
function Twebserver.Login(const AUserName:string; const APassword: string) : Tcustomer; stdcall;
You may also need to use AnsiString instead of string... the example methods I had the IDE add pass strings around but they are AnsiString (this applies to the fields in objects). HTTP and CGI specs (at least as far as I know) do not support Unicode directly, so the strings etc. you receive from and send to the client can only ever be standard 8 bit chars, you have to handle character encoding yourself.

The fact that it didn't create the log file (unless it's been created in some obscure location) suggests that the access violation is being raised by some of the inner workings, possibly relating to the parameter passing and types.

I hope this helps, if not, I'm afraid I've reached the limits of my knowledge on this type of service.