@faishal what about a nonce and permissions check? I suppose there's not anything in here that would be sensitively leaked, but probably better to restrict if it isn't needed by all users. So there could be a `check_ajax_referer` here, as well as a check to see if the user has the capabilities to even manage Stream options.