I have three nodes setup, and in my params.dat I've set anyone-can-create=false. However, on node-02 and node-03 i can issue "create stream MYSTREAM false" ... I expected to see a permission error. I can confirm that the new stream is in the blockchain because liststreams reflects the stream on on the other nodes.
I do have anyone-can-send=true set .. Does this override the create permission?