Same issue here when users try to upload pictures from the Activity Feed.
"DNNAPI requires a username and password."
Interestingly, the issue went away momentarily after upgrading to 7.0.03 and came back after about 2 days. I have made no changes to anything since the upgrade. Permissions are definitely good because this is the only module that's doing it.
Even more interesting is that it's also an issue on dotnetnuke.com. It's handled differently but it certainly seems to be the same issue since I have to double-click the upload button.
It seems to be isolated to Internet Explorer. IE 7, 8, 9, and 10 all do this but Chrome and Firefox work as expected.
I have been looking for a solution for a week now. The only thing that I can come up with is to recode the Journal module, which is pretty much the point that I am at with this. I'd love to find the actual cause before doing that, though.