So I guess you haven’t changed your admin password?
I was about to report this. The admin password is logged to the (world-readable) log file whenever I’m connected to the web server.
Should be fixed in next nightly. Left some debugging code in that was a *bit* too verbose.