Ability to completely disable authentication via stream.php and commented
out module authentication code within it.

http://victim//index.php?mod=admin&act=acl_enable_acl 
Authenticates correctly.

http://victim//stream.php?mod=admin&act=acl_enable_acl 
Does not.