On load, a signed-out visitor first asks the backend to sign them in as the user an authenticating proxy vouches for, before guest mode or a login redirect takes over; an explicit logout skips this for the rest of the tab. Settings gains a password card for signed-in users, where a proxy-signed-in user can set a password without the current one to log in without the proxy.