[amelius]

But that can easily be explained as a feature, not a bug.

[walterbell]

Most other sites do not automatically transfer your username and password/token from (insecure) email to web. Most other sites require authentication for a fully-logged-out user.