Web UI openly available on wan after TurrisOS 6.0 update, until reboot

After the update to TurrisOS 6.0, reForis was openly available from the internet (though LuCi was broken), and what's worse, it didn't require a password. It stopped happening after reboot, but administration was briefly openly available to the internet, until I noticed the router was broken and rebooted it. It did not reboot automatically, presumably due to #858 (closed). I notice that lighttpd is listening on all interfaces (0.0.0.0), it would be better if it only listened on br-lan.

I don't know if this is related, but I've got some port forwardings from port 80 and 443 on wan to a local computer, but wan input is set to REJECT.