Hmm, I wanted to add this, but it seems a bit redunant for the generic disable authentication setting (which also works for streams in the upcoming 0.5.2 release). Any reason why you want to enable authentication on the API but disable it on streams?
2013-01-13 21:18:32.49342 [(5)] WARN: User (host 192.168.4.4) requested a stream but isn't authenticated - denying access to stream