Hey @colin.magner, is the stream you provided still public? I can’t seem to access it anymore.
Not pointing any fingers here, but it seems like the problem may be on the Arup server? 
Just for clarification, you can set your credentials at the server level instead of “per-stream” and any streams you fetch will use the same credentials. Given your server is kind of private… I would just default to fetching everything with your token (public or private). I find this handier than setting the credentials on a “per-stream” basis.
Fetching any stream with a token will also provide the server with information on who is receiving the data. If you fetch it without a token, your commit’s won’t be tagged as received.
So I’d recommend, in general, using “Private Stream” option with your token and set it to the server url level.
Anyway, do let me know if the stream remains set to public, since i’m now getting “Your are not authorised” messages too! There may be some lurking bug that we need to look into!