Thanks for the FAQ. It was pretty easy to edit using emplode.

I've made the changes to the config.ini file and rebooted the player but I can still ftp into it without using a password. I'm guessing that I missed a step somewhere. Here is what I've got at the end of my config.ini:

[hijack]
kftpd_password=passwordhere
khttpd_files=0