There seems to be a session bug. I have to log in again every time I refresh the page. Of course, the page is updated automatically so the refresh is probably unnecessary, but the session bug is still there. :)
It's actually not a bug -- it's because the client never sends the password to the server. (It decrypts your wallet locally.)
It makes sense. It looks like they've just added this message: "If you refresh you will be automatically logged out since it isn't safe to keep your password on disk."
The funny thing to this is, that keeping the password on disk isn't proclaimed safe but sending each user the recovery code over plain text mail withouth encryption is...