There seems to be an issue with user accounts and permissions not applying to logged-in accounts, even if they haven't connected for days.
I removed a camera from the group for the user, and disabled a couple of other things, like viewing clips. Those permission changes are not being reflected for web users unless users specifically log themselves out and back in. I've even restarted (and updated) BI. Even disabling the account has them still able to view.