Using the documentation available here, the server continues to only honor the [install-dir]/conf/publish.password file. I am testing with QuickTime Broadcaster (RTSP) with both 4.05 & 4.06 on Windows 2012 R2.
I renamed the publish.password file located in the default Live Application directory to see if it is actually looking to it. In the root wowzastreamingengine_error.log I see the following which suggests that it is looking there:
ModuleCoreSecurity.onAppStart[live/definst]: Publish: RTMP Authorization: password file does not exist:‘F:\Wowza Streaming Engine\conf\live\publish.password’. RTMP Publishing disallowed.
My publish.password is set using the documented way:
Publish password file (format [username][space][password])
#username password
live live
Help! This is driving me nuts.