Two things from #60, both from @NotRetarded using 2.8.0.
Setting a password is now the first thing you do
Fresh installs never had an obvious "create a password" moment — you could set one under Settings, but nothing prompted you, and @NotRetarded went looking for an initial screen that wasn't there. It is now the first step of the setup wizard: a username and a password (typed twice), stored as a scrypt hash and never in plain text.
It is a gate. You leave that step either with a password or by deliberately ticking run without a password — which is a real choice for anyone behind a reverse proxy or on a network they trust, and stays supported. What you cannot do any more is end up on an open dashboard without having decided. The check is on the server, not just in the browser: a missing or mismatched password sends you back to the wizard, and the endpoint that used to skip the whole thing refuses to open a passwordless instance.
This is not retroactive. An install that has already been through setup is left exactly as it is, so upgrading does not suddenly demand a password from anyone running open on purpose. Set one any time under Settings › General.
The logout button renders again
It was the U+23FB power symbol, which a lot of system fonts do not carry, so it showed up as an empty box rather than an icon. It is an inline SVG now, like the theme toggle next to it.
Nothing to do on upgrade.