It does say on the top right that this is a beta site, so it's probably a weeee bit early to be making comments about "the new direction" and all that.
No, that's a release candidate. A beta is considered feature complete, but potentially not, and almost definitely somewhat buggy and/or non-performant. It's also often not undergone any major form of usability testing, and will often need to be modified to incorporate the results of that.
So it's still an option.
Websites should not make changes to a user's settings based simply on a GET against an URL, because the user can click the URL from a random stranger not knowing it would have that effect -- as I did.
Aside from being a poor user experience, what has happened here is someone has deliberately coded a security vulnerability. Granted the impact here is basically trivial, but it's still a pretty classic no-no, and should have immediately set off flashing lights and klaxons in any security-conscious developer's mind.