diff --git a/appsv/model/src/main/scala/com/debiki/core/EditedSettings.scala b/appsv/model/src/main/scala/com/debiki/core/EditedSettings.scala
index ef5f36fef..501b7024e 100644
--- a/appsv/model/src/main/scala/com/debiki/core/EditedSettings.scala
+++ b/appsv/model/src/main/scala/com/debiki/core/EditedSettings.scala
@@ -60,6 +60,7 @@ object ContentLicense {
   * Because only edited settings need to be saved to the database.
   */
 case class EditedSettings(
+  authnDiagConf: Opt[JsObject],
   userMustBeAuthenticated: Option[Boolean],
   userMustBeApproved: Option[Boolean],
   expireIdleAfterMins: Option[Int],
@@ -159,6 +160,8 @@ case class EditedSettings(
   enableTags: Option[Boolean],
   enableChat: Option[Boolean],
   enableDirectMessages: Option[Boolean],
+  enableAnonSens: Opt[Bo],
+  enablePresence: Opt[Bo],
   enableSimilarTopics: Option[Boolean],
   enableCors: Option[Boolean],
   allowCorsFrom: Option[String],
@@ -166,6 +169,8 @@ case class EditedSettings(
   showSubCommunities: Option[Boolean],
   showExperimental: Option[Boolean],
   featureFlags: Option[String],
+  ownDomains: Opt[St],
+  followLinksTo: Opt[St],
   allowEmbeddingFrom: Option[String],
   embeddedCommentsCategoryId: Option[CategoryId],
   htmlTagCssClasses: Option[String],
@@ -211,6 +216,7 @@ object EditedSettings {
   val MaxNumFirstPosts = 10
 
   val empty: EditedSettings = EditedSettings(
+    authnDiagConf = None,
     userMustBeAuthenticated = None,
     userMustBeApproved = None,
     expireIdleAfterMins = None,
@@ -310,6 +316,8 @@ object EditedSettings {
     enableTags = None,
     enableChat = None,
     enableDirectMessages = None,
+    enableAnonSens = None,
+    enablePresence = None,
     enableSimilarTopics = None,
     enableCors = None,
     allowCorsFrom = None,
@@ -317,6 +325,8 @@ object EditedSettings {
     showSubCommunities = None,
     showExperimental = None,
     featureFlags = None,
+    ownDomains = None,
+    followLinksTo = None,
     allowEmbeddingFrom = None,
     embeddedCommentsCategoryId = None,
     htmlTagCssClasses = None,
@@ -338,6 +348,7 @@ object EditedSettings {
   * settingsToSave.title.get.get.
   */
 case class SettingsToSave(
+  authnDiagConf: Opt[Opt[JsObject]] = None,
   userMustBeAuthenticated: Option[Option[Boolean]] = None,
   userMustBeApproved: Option[Option[Boolean]] = None,
   expireIdleAfterMins: Option[Option[Int]] = None,
@@ -437,6 +448,8 @@ case class SettingsToSave(
   enableTags: Option[Option[Boolean]] = None,
   enableChat: Option[Option[Boolean]] = None,
   enableDirectMessages: Option[Option[Boolean]] = None,
+  enableAnonSens: Opt[Opt[Bo]] = None,
+  enablePresence: Opt[Opt[Bo]] = None,
   enableSimilarTopics: Option[Option[Boolean]] = None,
   enableCors: Option[Option[Boolean]] = None,
   allowCorsFrom: Option[Option[String]] = None,
@@ -444,6 +457,8 @@ case class SettingsToSave(
   showSubCommunities: Option[Option[Boolean]] = None,
   showExperimental: Option[Option[Boolean]] = None,
   featureFlags: Option[Option[String]] = None,
+  ownDomains: Opt[Opt[St]] = None,
+  followLinksTo: Opt[Opt[St]] = None,
   allowEmbeddingFrom: Option[Option[String]] = None,
   embeddedCommentsCategoryId: Option[Option[CategoryId]] = None,
   htmlTagCssClasses: Option[Option[String]] = None,
diff --git a/appsv/model/src/main/scala/com/debiki/core/Site.scala b/appsv/model/src/main/scala/com/debiki/core/Site.scala
index d2e412c24..9a789b1cb 100644
--- a/appsv/model/src/main/scala/com/debiki/core/Site.scala
+++ b/appsv/model/src/main/scala/com/debiki/core/Site.scala
@@ -80,12 +80,22 @@ trait SiteTrait {
 
   def isTestSite: Bo = id <= Site.MaxTestSiteId
 
-  def isFeatureEnabled(ffName: St, serverFeatureFlags: St, onByDefault: Bo = false): Bo = {
+  def isFeatureEnabled(ffName: St, serverFeatureFlags: St, onByDefault: Bo = false): Bo =
+    SiteTrait.isFeatureEnabled(
+          ffName = ffName, siteFeatureFlags = featureFlags,
+          serverFeatureFlags = serverFeatureFlags, onByDefault = onByDefault)
+}
+
+
+// Move to somewhere better?
+object SiteTrait {
+  def isFeatureEnabled(ffName: St, siteFeatureFlags: St, serverFeatureFlags: St,
+          onByDefault: Bo = false): Bo = {
     val offName = "0" + ffName  // zero  — same as when disabling options in Vim
     val enabledWholeServer = serverFeatureFlags.contains(ffName)
     val disabledWholeServer = serverFeatureFlags.contains(offName)
-    val enabledThisSite = featureFlags.contains(ffName)
-    val disabledThisSite = featureFlags.contains(offName)
+    val enabledThisSite = siteFeatureFlags.contains(ffName)
+    val disabledThisSite = siteFeatureFlags.contains(offName)
     val enabledSomewhere = onByDefault || enabledWholeServer || enabledThisSite
     val disabledSomewhere = disabledWholeServer || disabledThisSite
 
diff --git a/appsv/model/src/main/scala/com/debiki/core/package.scala b/appsv/model/src/main/scala/com/debiki/core/package.scala
index e8ff6a387..92cb556c4 100644
--- a/appsv/model/src/main/scala/com/debiki/core/package.scala
+++ b/appsv/model/src/main/scala/com/debiki/core/package.scala
@@ -1115,6 +1115,7 @@ package object core {
     */
   sealed trait WhichAliasPat {
     def anyPat: Opt[Pat]
+    def anyAnonStatus: Opt[AnonStatus]
   }
 
 
@@ -1127,6 +1128,7 @@ package object core {
 
     case class SameAnon(anon: Anonym) extends WhichAliasPat {
       def anyPat: Opt[Pat] = Some(anon)
+      def anyAnonStatus: Opt[AnonStatus] = Some(anon.anonStatus)
     }
 
     /** Reuses any already existing anonym with the same anon status,
@@ -1137,6 +1139,7 @@ package object core {
       */
     case class LazyCreatedAnon(anonStatus: AnonStatus) extends WhichAliasPat {
       def anyPat: Opt[Pat] = None // might not yet exist
+      def anyAnonStatus: Opt[AnonStatus] = Some(anonStatus)
     }
 
     // Let's not support creating more than one anonym per user & page, for now.
diff --git a/appsv/rdb/src/main/resources/db/migration/db-wip.sql b/appsv/rdb/src/main/resources/db/migration/db-wip.sql
index 09a25cd53..acd34449c 100644
--- a/appsv/rdb/src/main/resources/db/migration/db-wip.sql
+++ b/appsv/rdb/src/main/resources/db/migration/db-wip.sql
@@ -722,6 +722,7 @@ Add?:
 
 
 page_html_cache_t   —  restrict col lengths
+-- ? add:  param_logged_in_c  bool,  to inc/exclude authn diag stuff? [cached_html_loggedin_param]
 
 
 -- Remove email "identities" from identities3?
diff --git a/appsv/rdb/src/main/scala/com/debiki/dao/rdb/SettingsSiteDaoMixin.scala b/appsv/rdb/src/main/scala/com/debiki/dao/rdb/SettingsSiteDaoMixin.scala
index 6fa4884cc..87e675598 100644
--- a/appsv/rdb/src/main/scala/com/debiki/dao/rdb/SettingsSiteDaoMixin.scala
+++ b/appsv/rdb/src/main/scala/com/debiki/dao/rdb/SettingsSiteDaoMixin.scala
@@ -59,6 +59,7 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
         site_id,
         category_id,
         page_id,
+        authn_diag_conf_c,
         user_must_be_auth,
         user_must_be_approved,
         expire_idle_after_mins,
@@ -157,6 +158,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
         enable_tags,
         enable_chat,
         enable_direct_messages,
+        enable_anon_posts_c,
+        enable_online_status_c,
         enable_similar_topics,
         enable_cors,
         allow_cors_from,
@@ -164,21 +167,24 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
         show_sub_communities,
         experimental,
         feature_flags,
+        own_domains_c,
+        follow_links_to_c,
         allow_embedding_from,
         embedded_comments_category_id,
         html_tag_css_classes)
-      values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+      values (?, ?, ?, ?::jsonb, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
           ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
           ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
           ?, ?, ?, ?::jsonb, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
           ?::jsonb, ?, ?, ?, ?, ?, ?,
-          ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       """
 
     val values = List(
       siteId.asAnyRef,
       NullInt,
       NullVarchar,
+      editedSettings2.authnDiagConf.getOrElse(None).orNullJson,
       editedSettings2.userMustBeAuthenticated.getOrElse(None).orNullBoolean,
       editedSettings2.userMustBeApproved.getOrElse(None).orNullBoolean,
       editedSettings2.expireIdleAfterMins.getOrElse(None).orNullInt,
@@ -277,6 +283,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
       editedSettings2.enableTags.getOrElse(None).orNullBoolean,
       editedSettings2.enableChat.getOrElse(None).orNullBoolean,
       editedSettings2.enableDirectMessages.getOrElse(None).orNullBoolean,
+      editedSettings2.enableAnonSens.getOrElse(None).orNullBoolean,
+      editedSettings2.enablePresence.getOrElse(None).orNullBoolean,
       editedSettings2.enableSimilarTopics.getOrElse(None).orNullBoolean,
       editedSettings2.enableCors.getOrElse(None).orNullBoolean,
       editedSettings2.allowCorsFrom.getOrElse(None).trimOrNullVarchar,
@@ -284,6 +292,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
       editedSettings2.showSubCommunities.getOrElse(None).orNullBoolean,
       editedSettings2.showExperimental.getOrElse(None).orNullBoolean,
       editedSettings2.featureFlags.getOrElse(None).trimOrNullVarchar,
+      editedSettings2.ownDomains.getOrElse(None).trimOrNullVarchar,
+      editedSettings2.followLinksTo.getOrElse(None).trimOrNullVarchar,
       editedSettings2.allowEmbeddingFrom.getOrElse(None).trimOrNullVarchar,
       editedSettings2.embeddedCommentsCategoryId.getOrElse(None).orNullInt,
       editedSettings2.htmlTagCssClasses.getOrElse(None).trimOrNullVarchar)
@@ -308,6 +318,7 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
     }
 
     val s = editedSettings2
+    maybeSet("authn_diag_conf_c", s.authnDiagConf.map(_.orNullJson))
     maybeSet("user_must_be_auth", s.userMustBeAuthenticated.map(_.orNullBoolean))
     maybeSet("user_must_be_approved", s.userMustBeApproved.map(_.orNullBoolean))
     maybeSet("expire_idle_after_mins", s.expireIdleAfterMins.map(_.orNullInt))
@@ -406,6 +417,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
     maybeSet("enable_tags", s.enableTags.map(_.orNullBoolean))
     maybeSet("enable_chat", s.enableChat.map(_.orNullBoolean))
     maybeSet("enable_direct_messages", s.enableDirectMessages.map(_.orNullBoolean))
+    maybeSet("enable_anon_posts_c", s.enableAnonSens.map(_.orNullBoolean))
+    maybeSet("enable_online_status_c", s.enablePresence.map(_.orNullBoolean))
     maybeSet("enable_similar_topics", s.enableSimilarTopics.map(_.orNullBoolean))
     maybeSet("enable_cors", s.enableCors.map(_.orNullBoolean))
     maybeSet("allow_cors_from", s.allowCorsFrom.map(_.orNullVarchar))
@@ -413,6 +426,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
     maybeSet("show_sub_communities", s.showSubCommunities.map(_.orNullBoolean))
     maybeSet("experimental", s.showExperimental.map(_.orNullBoolean))
     maybeSet("feature_flags", s.featureFlags.map(_.trimOrNullVarchar))
+    maybeSet("own_domains_c", s.ownDomains.map(_.trimOrNullVarchar))
+    maybeSet("follow_links_to_c", s.followLinksTo.map(_.trimOrNullVarchar))
     maybeSet("allow_embedding_from", s.allowEmbeddingFrom.map(_.trimOrNullVarchar))
     maybeSet("embedded_comments_category_id", s.embeddedCommentsCategoryId.map(_.orNullInt))
     maybeSet("html_tag_css_classes", s.htmlTagCssClasses.map(_.trimOrNullVarchar))
@@ -436,6 +451,7 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
 
   private def readSettingsFromResultSet(rs: ResultSet): EditedSettings = {
     EditedSettings(
+      authnDiagConf = getOptJsObject(rs, "authn_diag_conf_c"),
       userMustBeAuthenticated = getOptBoolean(rs, "user_must_be_auth"),
       userMustBeApproved = getOptBoolean(rs, "user_must_be_approved"),
       expireIdleAfterMins = getOptInt(rs, "expire_idle_after_mins"),
@@ -535,6 +551,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
       enableTags = getOptBool(rs, "enable_tags"),
       enableChat = getOptBool(rs, "enable_chat"),
       enableDirectMessages = getOptBool(rs, "enable_direct_messages"),
+      enableAnonSens = getOptBool(rs, "enable_anon_posts_c"),
+      enablePresence = getOptBool(rs, "enable_online_status_c"),
       enableSimilarTopics = getOptBool(rs, "enable_similar_topics"),
       enableCors = getOptBool(rs, "enable_cors"),
       allowCorsFrom = getOptString(rs, "allow_cors_from"),
@@ -542,6 +560,8 @@ trait SettingsSiteDaoMixin extends SiteTransaction {
       showSubCommunities = getOptBool(rs, "show_sub_communities"),
       showExperimental = getOptBool(rs, "experimental"),
       featureFlags = getOptString(rs, "feature_flags"),
+      ownDomains = getOptString(rs, "own_domains_c"),
+      followLinksTo = getOptString(rs, "follow_links_to_c"),
       allowEmbeddingFrom = getOptString(rs, "allow_embedding_from"),
       embeddedCommentsCategoryId = getOptInt(rs, "embedded_comments_category_id"),
       htmlTagCssClasses = getOptString(rs, "html_tag_css_classes"),
diff --git a/appsv/server/controllers/AdminController.scala b/appsv/server/controllers/AdminController.scala
index f7d7e7d45..d94257889 100644
--- a/appsv/server/controllers/AdminController.scala
+++ b/appsv/server/controllers/AdminController.scala
@@ -45,12 +45,12 @@ class AdminController @Inject()(cc: ControllerComponents, edContext: TyContext)
   // See   /-/edit-member   controllers.UserController.editMember
 
 
-  def redirectToAdminPage(): Action[Unit] = GetAction { _ =>
+  def redirectToAdminPage(): Action[Unit] = GetActionIsLogin { _ =>
     Redirect(routes.AdminController.viewAdminPage("").url)
   }
 
 
-  def viewAdminPage(whatever: String): Action[Unit] = AsyncGetAction { apiReq =>
+  def viewAdminPage(whatever: String): Action[Unit] = AsyncGetActionIsLogin { apiReq =>
     dieIfAssetsMissingIfDevTest()
 
     if (!apiReq.user.exists(_.isStaff)) {
diff --git a/appsv/server/controllers/LoginController.scala b/appsv/server/controllers/LoginController.scala
index 44b219a7e..835f52530 100644
--- a/appsv/server/controllers/LoginController.scala
+++ b/appsv/server/controllers/LoginController.scala
@@ -26,7 +26,7 @@ import javax.inject.Inject
 import play.api.libs.json.{JsNull, JsString, Json}
 import play.api.mvc._
 import talkyard.server.TyLogging
-import talkyard.server.authn.LoginReason
+import talkyard.server.authn.{LoginReason, MinAuthnStrength}
 import talkyard.server.JsX
 
 
@@ -37,6 +37,7 @@ class LoginController @Inject()(cc: ControllerComponents, edContext: TyContext)
 
   import context.globals
   import context.security.DiscardingSessionCookies
+  import context.plainApiActions.PlainApiAction
   import LoginController._
 
 
@@ -124,18 +125,22 @@ class LoginController @Inject()(cc: ControllerComponents, edContext: TyContext)
 
   /** Clears session cookies and ends the session server side too; unsubscribes
     * from any websockets channel.
+    *
+    * (Using `PlainApiAction` instead of `GetActionAllowAnyone` so can set `ignoreAlias`.)
     */
-  def logout(currentUrlPath: Opt[St]): Action[U] = GetActionAllowAnyone { request =>
-    SECURITY // optionally log out from all devices?
+  def logout_get_post(currentUrlPath: Opt[St]): Action[U] = PlainApiAction(
+        cc.parsers.empty, RateLimits.NoRateLimits, MinAuthnStrength.EmbeddingStorageSid12,
+        allowAnyone = true, ignoreAlias = true) { request =>
     doLogout(request, redirectIfMayNotSeeUrlPath = currentUrlPath,
           wasImpersonating = false)
   }
 
 
-  def doLogout(request: GetRequest, redirectIfMayNotSeeUrlPath: Opt[St],
+  def doLogout(request: ApiRequest[_], redirectIfMayNotSeeUrlPath: Opt[St],
           wasImpersonating: Bo): Result = {
     import request.{dao, requester, siteSettings}
 
+    SECURITY // optionally log out from all devices?
     AUDIT_LOG // session id destruction
 
     requester foreach { theRequester =>
diff --git a/appsv/server/controllers/SuperAdminController.scala b/appsv/server/controllers/SuperAdminController.scala
index 08be7b693..86ba3ba08 100644
--- a/appsv/server/controllers/SuperAdminController.scala
+++ b/appsv/server/controllers/SuperAdminController.scala
@@ -188,7 +188,8 @@ class SuperAdminController @Inject()(cc: ControllerComponents, edContext: TyCont
     if (inclStaff) {
       json += "staffUsers" -> JsArray(siteStuff.staff.map { staffUser =>
         JsUserInclDetails(
-          staffUser, usersById = Map.empty, groups = Nil, callerIsAdmin = true)
+              staffUser, usersById = Map.empty, groups = Nil, callerIsAdmin = true,
+              maySeePresence = true, sensitiveAnonDisc = false)
       })
     }
     json
diff --git a/appsv/server/controllers/UserController.scala b/appsv/server/controllers/UserController.scala
index 6db2ee96d..1f44ca5f3 100644
--- a/appsv/server/controllers/UserController.scala
+++ b/appsv/server/controllers/UserController.scala
@@ -54,8 +54,9 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
   val MaxEmailsPerUser: Int = 5  // also in js [4GKRDF0]
 
 
-  def listCompleteUsers(whichUsers: String): Action[Unit] = StaffGetAction { request =>
-    val settings = request.dao.getWholeSiteSettings()
+  def listCompleteUsers(whichUsers: St): Action[Unit] = StaffGetAction { req =>
+    import req.dao
+    val settings = dao.getWholeSiteSettings()
     var orderOffset: PeopleOrderOffset = PeopleOrderOffset.BySignedUpAtDesc
     var peopleFilter = PeopleFilter()
 
@@ -85,7 +86,7 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
 
     val peopleQuery = PeopleQuery(orderOffset, peopleFilter)
 
-    request.dao.readOnlyTransaction { tx =>
+    dao.readTx { tx =>
       // Ok to load also deactivated users — the requester is staff.
       val membersAndStats = tx.loadUsersInclDetailsAndStats(peopleQuery)
       val members = membersAndStats.map(_._1)
@@ -96,8 +97,11 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
       val usersJson = JsArray(membersAndStats.map(memberAndStats => {
         val member: UserInclDetails = memberAndStats._1
         val anyStats: Option[UserStats] = memberAndStats._2
-        JsUserInclDetails(member, usersById, groups = Nil, callerIsAdmin = request.theUser.isAdmin,
-          callerIsStaff = true, anyStats = anyStats)
+        JsUserInclDetails(member, usersById, groups = Nil,
+              callerIsAdmin = req.theUser.isAdmin,
+              sensitiveAnonDisc = settings.enableAnonSens,
+              maySeePresence = settings.enablePresence,
+              callerIsStaff = true, anyStats = anyStats)
       }))
       OkSafeJson(Json.obj("users" -> usersJson))
     }
@@ -158,6 +162,7 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
         request: DebikiRequest[_]): (JsObject, JsValue, Pat) = {
     import request.dao
 
+    val settings = dao.getWholeSiteSettings()
     val callerIsStaff = request.user.exists(_.isStaff)
     val callerIsAdmin = request.user.exists(_.isAdmin)
     val callerIsUserHerself = request.user.exists(_.id == userId)
@@ -165,7 +170,7 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
     val reqrPerms: EffPatPerms =
           dao.deriveEffPatPerms(request.authzContext.groupIdsEveryoneLast)
 
-    request.dao.readOnlyTransaction { tx =>
+    request.dao.readTx { tx =>
       val stats = includeStats ? tx.loadUserStats(userId) | None
       val (pptJson, pat) =
         if (Participant.isRoleId(userId)) {
@@ -175,6 +180,8 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
             case m: UserInclDetails =>
               JsUserInclDetails(m, Map.empty, groups, callerIsAdmin = callerIsAdmin,
                     callerIsStaff = callerIsStaff, callerIsUserHerself = callerIsUserHerself,
+                    maySeePresence = settings.enablePresence,
+                    sensitiveAnonDisc = settings.enableAnonSens,
                     reqrPerms = Some(reqrPerms))
             case g: Group =>
               jsonForGroupInclDetails(g, callerIsAdmin = callerIsAdmin,
@@ -193,7 +200,10 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
         }
       dieIf(pat.id != userId, "TyE36WKDJ03")
       (pptJson,
-          stats.map(JsUserStats(_, isStaffOrSelf, Some(reqrPerms))).getOrElse(JsNull),
+          stats.map(JsUserStats(_, Some(reqrPerms), callerIsStaff = callerIsStaff,
+                callerIsUserHerself = callerIsUserHerself,
+                callerIsAdmin = callerIsAdmin, maySeePresence = settings.enablePresence,
+                sensitiveAnonDisc = settings.enableAnonSens)).getOrElse(JsNull),
           pat.noDetails)
     }
   }
@@ -205,6 +215,7 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
         : (JsObject, JsValue, Participant) = {
     import request.{dao}
 
+    val settings = dao.getWholeSiteSettings()
     val callerIsStaff = request.user.exists(_.isStaff)
     val callerIsAdmin = request.user.exists(_.isAdmin)
     val reqrPerms: EffPatPerms =
@@ -254,9 +265,16 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
           val userJson = JsUserInclDetails(
                 user, Map.empty, groups, callerIsAdmin = callerIsAdmin,
                 callerIsStaff = callerIsStaff, callerIsUserHerself = callerIsUserHerself,
+                maySeePresence = settings.enablePresence,
+                sensitiveAnonDisc = settings.enableAnonSens,
                 reqrPerms = Some(reqrPerms))
           (userJson,
-              stats.map(JsUserStats(_, isStaffOrSelf, Some(reqrPerms))).getOrElse(JsNull),
+              stats.map(JsUserStats(_, Some(reqrPerms),
+                    callerIsStaff = callerIsStaff, callerIsAdmin = callerIsAdmin,
+                    callerIsUserHerself = callerIsUserHerself,
+                    maySeePresence = settings.enablePresence,
+                    sensitiveAnonDisc = settings.enableAnonSens,
+                    )).getOrElse(JsNull),
               user.noDetails)
         case group: GroupVb =>
           val groupJson = jsonForGroupInclDetails(
@@ -358,7 +376,10 @@ class UserController @Inject()(cc: ControllerComponents, edContext: TyContext)
       }
 
       val anyStats: Option[UserStats] = tx.loadUserStats(userId)
-      val statsJson = anyStats.map(JsUserStats(_, isStaffOrSelf = true, reqrPerms = None)
+      val statsJson = anyStats.map(JsUserStats(_, reqrPerms = None,
+                    callerIsStaff = false, callerIsAdmin = false, // does'nt matter
+                    callerIsUserHerself = true,
+                    maySeePresence = true, sensitiveAnonDisc = false)
             ) getOrElse JsNull
 
       val otherEmailAddresses =
diff --git a/appsv/server/controllers/ViewPageController.scala b/appsv/server/controllers/ViewPageController.scala
index 513aa2983..22dd9418c 100644
--- a/appsv/server/controllers/ViewPageController.scala
+++ b/appsv/server/controllers/ViewPageController.scala
@@ -21,6 +21,7 @@ import com.debiki.core._
 import com.debiki.core.Prelude._
 import debiki.RateLimits.NoRateLimits
 import debiki._
+import debiki.dao.UsersOnlineStuff
 import debiki.EdHttp._
 import talkyard.server.http._
 import play.api.libs.json._
@@ -428,12 +429,14 @@ object ViewPageController {
         embeddingUrl: Option[String] = None,
         skipUsersOnline: Boolean = false, xsrfTokenIfNoCookies: Option[String] = None): Future[Result] = {
     import request.{dao, requester}
+    val settings = dao.getWholeSiteSettings()
 
     // Could do asynchronously later. COULD avoid sending back empty json fields
     // — first verify that then nothing will break though.
-    val usersOnlineStuff =
-      if (skipUsersOnline) NoUsersOnlineStuff
-      else dao.getUsersOnlineStuff()
+    // In some situations, can be good if [admins_see_presence]. Related to [joint_decisions]?
+    val usersOnlineStuff: Opt[UsersOnlineStuff] =
+          if (skipUsersOnline || !settings.enablePresence) None
+          else Some(dao.getUsersOnlineStuff())
 
     val anyMeAndRestrStuff: Opt[MeAndStuff] =
       request match {
@@ -444,8 +447,8 @@ object ViewPageController {
       }
 
     var volatileJson = Json.obj(  // ts: VolatileDataFromServer
-      "usersOnline" -> usersOnlineStuff.cachedUsersJson,
-      "numStrangersOnline" -> usersOnlineStuff.numStrangers,
+      "usersOnline" -> usersOnlineStuff.map(_.cachedUsersJson),
+      "numStrangersOnline" -> usersOnlineStuff.map(_.numStrangers),
       "me" -> JsObjOrNull(anyMeAndRestrStuff.map(_.me.meJsOb)),
       "stuffForMe" -> JsObjOrNull(anyMeAndRestrStuff.map(_.stuffForMe.toJson(dao))),
       )
diff --git a/appsv/server/debiki/RateLimits.scala b/appsv/server/debiki/RateLimits.scala
index 6f01115eb..0d2ffe361 100644
--- a/appsv/server/debiki/RateLimits.scala
+++ b/appsv/server/debiki/RateLimits.scala
@@ -313,6 +313,9 @@ object RateLimits {
   val ReadsFromCache = ReadsFromDb  // for now
 
 
+  val ReadsFromCacheALot = ReadsFromDb  // for now
+
+
   object AdminWritesToDb extends RateLimits {
     val key = "AdWr"
     val what = "sent too many resource consuming HTTP requests"
diff --git a/appsv/server/debiki/ReactJson.scala b/appsv/server/debiki/ReactJson.scala
index 42b05beaa..5ef90a896 100644
--- a/appsv/server/debiki/ReactJson.scala
+++ b/appsv/server/debiki/ReactJson.scala
@@ -544,6 +544,16 @@ class JsonMaker(dao: SiteDao) {
       anyCurCatId.foreach(id => jsonObj += "listingCatId" -> JsNumber(id))
     }
 
+    COULD_OPTIMIZE; SAVE_BANDWIDTH // Add only if needed  [authn_diag_bandw], that is,
+    // if user not logged in.  Maybe inject at the bottom in a new <script> placeholder?
+    // (Can't do > 1 from the top, since there's people's comments in one already,
+    // which could include placeholder strings.)
+    SAVE_BANDWIDTH // Exclude enableGoogleLogin, FacebookLogin, allowSignup, customIdps ...
+    // too, if already logged in. [cached_html_loggedin_param]?
+    if (siteSettings.authnDiagConf.value.nonEmpty) {
+      jsonObj += "authnDiagConf" -> siteSettings.authnDiagConf
+    }
+
     val reactStoreJsonString = jsonObj.toString()
 
     val version = CachedPageVersion(
@@ -577,7 +587,7 @@ class JsonMaker(dao: SiteDao) {
     val everyoneGroup = dao.getTheGroup(Group.EveryoneId)
     val idps = dao.getSiteCustomIdentityProviders(onlyEnabled = true)
 
-    val result = Json.obj(
+    var result = Json.obj(
       "dbgSrc" -> "SpecPgJ",
       "widthLayout" -> (if (request.isMobile) WidthLayout.Tiny else WidthLayout.Medium).toInt,
       "isEmbedded" -> false,  // what ??? Yes, if in emb editor iframe
@@ -607,6 +617,11 @@ class JsonMaker(dao: SiteDao) {
       // see:  [search_page_cats_tags]  maybe can just leave it at that.
       "publicCategories" -> JsArray())
 
+    // No need to incl authn diag text, if the person has logged in already.
+    if (siteSettings.authnDiagConf.value.nonEmpty) {
+      result += "authnDiagConf" -> siteSettings.authnDiagConf
+    }
+
     result
   }
 
@@ -1619,6 +1634,10 @@ object JsonMaker {
       json += "enableChat" -> JsBoolean(settings.enableChat)
     if (settings.enableDirectMessages != D.enableDirectMessages)
       json += "enableDirectMessages" -> JsBoolean(settings.enableDirectMessages)
+    if (settings.enableAnonSens != D.enableAnonSens)
+      json += "enableAnonSens" -> JsBoolean(settings.enableAnonSens)
+    if (settings.enablePresence != D.enablePresence)
+      json += "enablePresence" -> JsBoolean(settings.enablePresence)
     if (settings.enableSimilarTopics != D.enableSimilarTopics)
       json += "enableSimilarTopics" -> JsBoolean(settings.enableSimilarTopics)
     if (settings.showSubCommunities != D.showSubCommunities)
diff --git a/appsv/server/debiki/dao/SettingsDao.scala b/appsv/server/debiki/dao/SettingsDao.scala
index 5dafdcfc8..bf9f3a26a 100644
--- a/appsv/server/debiki/dao/SettingsDao.scala
+++ b/appsv/server/debiki/dao/SettingsDao.scala
@@ -23,6 +23,7 @@ import debiki._
 import debiki.EdHttp.throwBadRequest
 import debiki.EdHttp.throwBadRequestIf
 import play.api.libs.json.JsObject
+import scala.collection.{immutable => imm}
 
 
 /** Loads and saves settings for the whole website, a section of the website (e.g.
@@ -67,9 +68,10 @@ trait SettingsDao {
             "TyE406RKTP245", s"Too long: $name")
     }
 
-    def checkJsonLen(name: St, getter: SettingsToSave => Opt[Opt[JsObject]]) {
+    def checkJsonLen(name: St, getter: SettingsToSave => Opt[Opt[JsObject]],
+          max: i32 = defMaxLength) {
       val anyOptVal = getter(settingsToSave)
-      throwBadRequestIf(anyOptVal.exists(_.exists(_.toString.length > defMaxLength)),
+      throwBadRequestIf(anyOptVal.exists(_.exists(_.toString.length > max)),
             "TyE50MRTQJ2", s"Too long: $name")
     }
 
@@ -90,6 +92,13 @@ trait SettingsDao {
     checkLen("socialLinksHtml", _.socialLinksHtml)  // settings_c_sociallinkshtml_len
     checkJsonLen("navConf", _.navConf)              // settings_c_navconf_len
 
+    // This one is <= 8k (authn_diag_conf_c is jsonb_ste8000_d). Let's subtract 500 so
+    // errors will happen in the app server not the database (then, better error messages).
+    // But for now: Let's say 750 at most, to save bandwidth.  [authn_diag_bandw]
+    // Typically an intro text isn't more than about 100 chars. But image urls can
+    // be a bit long, say 200 chars. Anyway, 500 should be enough, let's say 750.
+    checkJsonLen("authnDiagConf", _.authnDiagConf, max = 750) // 8000 - 500)
+
     readWriteTransaction { tx =>
       val oldSettings = loadWholeSiteSettings(tx)
 
@@ -98,9 +107,9 @@ trait SettingsDao {
 
       tx.upsertSiteSettings(settingsToSave)
       val newSettings = loadWholeSiteSettings(tx)
-      newSettings.findAnyError foreach { error =>
+      newSettings.findAnyErrors foreach { errors: imm.Seq[St] =>
         // This'll rollback the transaction.
-        throwBadRequest("EsE40GY28", s"Bad settings: $error")
+        throwBadRequest("TyESETNGS", s"Bad settings, problems:\n - ${errors.mkString("\n - ")}")
       }
 
       lazy val admins = tx.loadAdmins()
diff --git a/appsv/server/debiki/dao/SiteDao.scala b/appsv/server/debiki/dao/SiteDao.scala
index 031e88a4c..884d5930b 100644
--- a/appsv/server/debiki/dao/SiteDao.scala
+++ b/appsv/server/debiki/dao/SiteDao.scala
@@ -948,7 +948,18 @@ object SiteDao extends TyLogging {
     //   things as sbd else if in an old discussion one was sbd else.
     // }
 
-    anyAliasPatInReqBody getOrElse modeAlias
+    val which = anyAliasPatInReqBody getOrElse modeAlias
+
+    // Anon sensitive discussions enabled?
+    val anyAnonStatus: Opt[AnonStatus] = which.flatMap(_.anyAnonStatus)
+    // For now, safest to assume that any anon-status except for the Ideation purpose
+    // (that is, AnonStatus.IsAnonCanAutoDeanon) is sensitive discussions.
+    val isAnonSens = anyAnonStatus.exists(_ != AnonStatus.IsAnonCanAutoDeanon)
+    if (isAnonSens && !dao.getWholeSiteSettings().enableAnonSens)
+      throwForbidden("TyE0ANONSENS", // [reject_anon_sensitive_posts]
+            "Sensitive anonymous discussions aren't enabled (any longer)")
+
+    which
   }
 
 
diff --git a/appsv/server/debiki/settings.scala b/appsv/server/debiki/settings.scala
index 2c5fc24ec..ae4165991 100644
--- a/appsv/server/debiki/settings.scala
+++ b/appsv/server/debiki/settings.scala
@@ -23,6 +23,7 @@ import play.api.libs.json._
 import scala.collection.immutable
 import debiki.EdHttp.throwBadRequest
 import scala.collection.mutable.ArrayBuffer
+import scala.collection.{immutable => imm}
 import scala.util.matching.Regex
 import talkyard.server.JsX._
 
@@ -31,6 +32,7 @@ import talkyard.server.JsX._
 trait AllSettings extends DiscProps {
   self =>
 
+  def authnDiagConf: JsObject
   def userMustBeAuthenticated: Boolean  ; RENAME // to mustLoginToRead ?
   def userMustBeApproved: Boolean       ; RENAME // to mustLoginToContribute?
       // Need to change how it works too: in the db, set mustBeAuthenticatedToRead = true  [2KZMQ5]
@@ -234,6 +236,8 @@ trait AllSettings extends DiscProps {
     */
   def enableChat: Boolean
   def enableDirectMessages: Boolean
+  def enableAnonSens: Bo
+  def enablePresence: Bo
   def enableSimilarTopics: Boolean
 
   /** CORS means Cross-Origin Resource Sharing. */
@@ -245,6 +249,9 @@ trait AllSettings extends DiscProps {
   def showExperimental: Boolean
   def featureFlags: String
 
+  def ownDomains: St
+  def followLinksTo: St
+
   def allowEmbeddingFrom: String
   def embeddedCommentsCategoryId: CategoryId
   def htmlTagCssClasses: String
@@ -263,6 +270,7 @@ trait AllSettings extends DiscProps {
 
   // Pretend all settings have been edited, so they all will be included in the json.
   private def toEditedSettings = EditedSettings(
+    authnDiagConf = Some(self.authnDiagConf),
     userMustBeAuthenticated = Some(self.userMustBeAuthenticated),
     userMustBeApproved = Some(self.userMustBeApproved),
     expireIdleAfterMins = Some(self.expireIdleAfterMins),
@@ -362,6 +370,8 @@ trait AllSettings extends DiscProps {
     enableTags = Some(self.enableTags),
     enableChat = Some(self.enableChat),
     enableDirectMessages = Some(self.enableDirectMessages),
+    enableAnonSens = Some(self.enableAnonSens),
+    enablePresence = Some(self.enablePresence),
     enableSimilarTopics = Some(self.enableSimilarTopics),
     enableCors = Some(self.enableCors),
     allowCorsFrom = Some(self.allowCorsFrom),
@@ -369,6 +379,8 @@ trait AllSettings extends DiscProps {
     showSubCommunities = Some(self.showSubCommunities),
     showExperimental = Some(self.showExperimental),
     featureFlags = Some(self.featureFlags),
+    ownDomains = Some(self.ownDomains),
+    followLinksTo = Some(self.followLinksTo),
     allowEmbeddingFrom = Some(self.allowEmbeddingFrom),
     embeddedCommentsCategoryId = Some(self.embeddedCommentsCategoryId),
     htmlTagCssClasses = Some(self.htmlTagCssClasses),
@@ -399,6 +411,21 @@ object AllSettings {
   val InConfigFile = "(in config file)"
 
   def makeDefault(globals: Globals): AllSettings = new AllSettings {  // [8L4KWU02]
+    // Looks like:  { c0: [{ headerText, introHtml, imageUrl, ... }] }
+    val authnDiagConf = Json.obj("c0" -> Json.arr(
+          Json.obj(
+            "headerText" -> "",
+            "introHtml" -> "",
+            "imageUrl" -> "",
+            "continueWithCta" -> "",
+            "orCreateAcctCta" -> "",
+            "orLogInCta" -> "",
+            "orTypeGuestNameCta" -> "",
+            "signUpCta" -> "",
+            "logInCta" -> "",
+            "guestNameCta" -> "",
+            )))
+
     val userMustBeAuthenticated = false
     val userMustBeApproved = false
     // One year. Like Gmail and Facebook (well, they have forever, instead). A Talkyard
@@ -512,6 +539,8 @@ object AllSettings {
     val enableTags = true
     val enableChat = true
     val enableDirectMessages = true
+    val enableAnonSens = false
+    val enablePresence = true
     val enableSimilarTopics = true
     val enableCors = false
     val allowCorsFrom = ""
@@ -519,6 +548,8 @@ object AllSettings {
     val showSubCommunities = false
     val showExperimental = false
     val featureFlags = ""
+    val ownDomains = ""
+    val followLinksTo = ""
     val allowEmbeddingFrom = ""
     val embeddedCommentsCategoryId: CategoryId = NoCategoryId
     val htmlTagCssClasses = ""
@@ -547,6 +578,7 @@ case class EffectiveSettings(
     None
   }
 
+  def authnDiagConf: JsObject = firstInChain(_.authnDiagConf) getOrElse default.authnDiagConf
   def userMustBeAuthenticated: Boolean = firstInChain(_.userMustBeAuthenticated) getOrElse default.userMustBeAuthenticated
   def userMustBeApproved: Boolean = firstInChain(_.userMustBeApproved) getOrElse default.userMustBeApproved
   def expireIdleAfterMins: Int = firstInChain(_.expireIdleAfterMins) getOrElse default.expireIdleAfterMins
@@ -646,6 +678,8 @@ case class EffectiveSettings(
   def enableTags: Boolean = firstInChain(_.enableTags) getOrElse default.enableTags
   def enableChat: Boolean = firstInChain(_.enableChat) getOrElse default.enableChat
   def enableDirectMessages: Boolean = firstInChain(_.enableDirectMessages) getOrElse default.enableDirectMessages
+  def enableAnonSens: Bo = firstInChain(_.enableAnonSens) getOrElse default.enableAnonSens
+  def enablePresence: Bo = firstInChain(_.enablePresence) getOrElse default.enablePresence
   def enableSimilarTopics: Boolean = firstInChain(_.enableSimilarTopics) getOrElse default.enableSimilarTopics
   def enableCors: Boolean = firstInChain(_.enableCors) getOrElse default.enableCors
   def allowCorsFrom: String = firstInChain(_.allowCorsFrom) getOrElse default.allowCorsFrom
@@ -653,6 +687,8 @@ case class EffectiveSettings(
   def showSubCommunities: Boolean = firstInChain(_.showSubCommunities) getOrElse default.showSubCommunities
   def showExperimental: Boolean = firstInChain(_.showExperimental) getOrElse default.showExperimental
   def featureFlags: String = firstInChain(_.featureFlags) getOrElse default.featureFlags
+  def ownDomains: St = firstInChain(_.ownDomains) getOrElse default.ownDomains
+  def followLinksTo: St = firstInChain(_.followLinksTo) getOrElse default.followLinksTo
   def allowEmbeddingFrom: String = firstInChain(_.allowEmbeddingFrom) getOrElse default.allowEmbeddingFrom
   def embeddedCommentsCategoryId: CategoryId = firstInChain(_.embeddedCommentsCategoryId) getOrElse default.embeddedCommentsCategoryId
   def htmlTagCssClasses: String = firstInChain(_.htmlTagCssClasses) getOrElse default.htmlTagCssClasses
@@ -719,10 +755,24 @@ case class EffectiveSettings(
           blockListText = emailDomainBlacklist, allowByDefault = true)
   }
 
-  /** Finds any invalid setting value, or invalid settings configurations. */
-  def findAnyError: Option[String] = {
-    // Hmm ...
-    None
+
+  /** Finds any invalid setting value, or invalid settings configurations.
+    */
+  def findAnyErrors: Opt[imm.Seq[St]] = {
+    val probs = MutArrBuf[St]()
+
+    if (enableAnonSens && enablePresence) {
+      // [deanon_risk] [anon_sens_0_presence]
+      probs.append("Can't enable both 1) Sensitive Anonymous Discussions and 2) Presence")
+    }
+
+    if (enableAnonSens && !showCategories) {
+      // For now, anon sensitive discussions are configured per category. [anon_purp_per_cat]
+      probs.append("Can't enable Sensitive Anonymous Discussions when not using categories")
+    }
+
+    if (probs.isEmpty) None
+    else Some(probs.to[imm.Seq])
   }
 
 }
@@ -823,6 +873,7 @@ object Settings2 {
   def settingsToJson(editedSettings2: EditedSettings): JsObject = {
     val s = editedSettings2
     Json.obj(
+      "authnDiagConf" -> JsObjOrNull(s.authnDiagConf),
       "userMustBeAuthenticated" -> JsBooleanOrNull(s.userMustBeAuthenticated),
       "userMustBeApproved" -> JsBooleanOrNull(s.userMustBeApproved),
       "expireIdleAfterMins" -> JsNumberOrNull(s.expireIdleAfterMins),
@@ -922,6 +973,8 @@ object Settings2 {
       "enableTags" -> JsBooleanOrNull(s.enableTags),
       "enableChat" -> JsBooleanOrNull(s.enableChat),
       "enableDirectMessages" -> JsBooleanOrNull(s.enableDirectMessages),
+      "enableAnonSens" -> JsBooleanOrNull(s.enableAnonSens),
+      "enablePresence" -> JsBooleanOrNull(s.enablePresence),
       "enableSimilarTopics" -> JsBooleanOrNull(s.enableSimilarTopics),
       "enableCors" -> JsBooleanOrNull(s.enableCors),
       "allowCorsFrom" -> JsStringOrNull(s.allowCorsFrom),
@@ -929,6 +982,8 @@ object Settings2 {
       "showSubCommunities" -> JsBooleanOrNull(s.showSubCommunities),
       "showExperimental" -> JsBooleanOrNull(s.showExperimental),
       "featureFlags" -> JsStringOrNull(s.featureFlags),
+      "ownDomains" -> JsStringOrNull(s.ownDomains),
+      "followLinksTo" -> JsStringOrNull(s.followLinksTo),
       "allowEmbeddingFrom" -> JsStringOrNull(s.allowEmbeddingFrom),
       "embeddedCommentsCategoryId" -> JsNumberOrNull(s.embeddedCommentsCategoryId),
       "htmlTagCssClasses" -> JsStringOrNull(s.htmlTagCssClasses),
@@ -945,6 +1000,7 @@ object Settings2 {
   def settingsToSaveFromJson(json: JsValue, globals: Globals): SettingsToSave = {
     val d = AllSettings.makeDefault(globals)
     SettingsToSave(
+    authnDiagConf = anyJsObj(json, "authnDiagConf", d.authnDiagConf),
     userMustBeAuthenticated = anyBool(json, "userMustBeAuthenticated", d.userMustBeAuthenticated),
     userMustBeApproved = anyBool(json, "userMustBeApproved", d.userMustBeApproved),
     expireIdleAfterMins = anyInt(json, "expireIdleAfterMins", d.expireIdleAfterMins),
@@ -1048,6 +1104,8 @@ object Settings2 {
     enableTags = anyBool(json, "enableTags", d.enableTags),
     enableChat = anyBool(json, "enableChat", d.enableChat),
     enableDirectMessages = anyBool(json, "enableDirectMessages", d.enableDirectMessages),
+    enableAnonSens = anyBool(json, "enableAnonSens", d.enableAnonSens),
+    enablePresence = anyBool(json, "enablePresence", d.enablePresence),
     enableSimilarTopics = anyBool(json, "enableSimilarTopics", d.enableSimilarTopics),
     enableCors = anyBool(json, "enableCors", d.enableCors),
     allowCorsFrom = anyString(json, "allowCorsFrom", d.allowCorsFrom),
@@ -1055,6 +1113,8 @@ object Settings2 {
     showSubCommunities = anyBool(json, "showSubCommunities", d.showSubCommunities),
     showExperimental = anyBool(json, "showExperimental", d.showExperimental),
     featureFlags = anyString(json, "featureFlags", d.featureFlags),
+    ownDomains = anyString(json, "ownDomains", d.ownDomains),
+    followLinksTo = anyString(json, "followLinksTo", d.followLinksTo),
     allowEmbeddingFrom = anyString(json, "allowEmbeddingFrom", d.allowEmbeddingFrom),
     embeddedCommentsCategoryId = anyInt(json, "embeddedCommentsCategoryId", d.embeddedCommentsCategoryId),
     htmlTagCssClasses = anyString(json, "htmlTagCssClasses", d.htmlTagCssClasses),
diff --git a/appsv/server/talkyard/server/JsX.scala b/appsv/server/talkyard/server/JsX.scala
index 3a8e60fbc..661a20a20 100644
--- a/appsv/server/talkyard/server/JsX.scala
+++ b/appsv/server/talkyard/server/JsX.scala
@@ -286,18 +286,21 @@ object JsX {   RENAME // to JsonPaSe
         usersById: Map[UserId, User], // CLEAN_UP remove, send back a user map instead
         groups: immutable.Seq[Group],
         callerIsAdmin: Bo, callerIsStaff: Bo = false, callerIsUserHerself: Bo = false,
+        maySeePresence: Bo, sensitiveAnonDisc: Bo,
         reqrPerms: Opt[EffPatPerms] = None,
         anyStats: Option[UserStats] = None, inclPasswordHash: Bo = false)
       : JsObject = {
+
     def callerIsStaff_ = callerIsAdmin || callerIsStaff
+    val reqrIsStaffOrSelf = callerIsStaff_ || callerIsUserHerself
+
     dieIf(inclPasswordHash && !callerIsAdmin, "TyE305KSJWG2")
+
     var userJson = Json.obj(  // MemberInclDetails  [B28JG4]
       "id" -> user.id,
       "ssoId" -> JsStringOrNull(user.ssoId),
       "externalId" -> JsStringOrNull(user.ssoId),  // deprecated 2020-03-25 [395KSH20]
       "extId" -> JsStringOrNull(user.extId),
-      "createdAtEpoch" -> JsNumber(user.createdAt.millis),  // REMOVE
-      "createdAtMs" -> JsNumber(user.createdAt.millis),  // RENAME
       "username" -> user.username,
       "fullName" -> user.fullName,
       "isAdmin" -> user.isAdmin,
@@ -317,11 +320,17 @@ object JsX {   RENAME // to JsonPaSe
       "suspendedTillMs" -> DateEpochOrNull(user.suspendedTill),  // RENAME
       "effectiveTrustLevel" -> user.effectiveTrustLevel.toInt)
 
+    if (reqrIsStaffOrSelf || maySeePresence) {
+      // Later: [see_presence_start_date]
+      userJson += "createdAtEpoch" -> JsNumber(user.createdAt.millis)  // REMOVE
+      userJson += "createdAtMs" -> JsNumber(user.createdAt.millis)  // RENAME
+      // (Don't think need not exclude deletedAt & suspendedTillMs)
+    }
+
     // Currently needs to be public, see [some_pub_priv_prefs].
     userJson = userJson.addAnyInt32("maySendMeDmsTrLv", user.privPrefs.maySendMeDmsTrLv)
     userJson = userJson.addAnyInt32("mayMentionMeTrLv", user.privPrefs.mayMentionMeTrLv)
 
-    val reqrIsStaffOrSelf = callerIsStaff_ || callerIsUserHerself
     val maySeeEmailAdrs = reqrPerms.exists(_.canSeeOthersEmailAdrs)
 
     if (reqrIsStaffOrSelf || maySeeEmailAdrs) {
@@ -378,7 +387,10 @@ object JsX {   RENAME // to JsonPaSe
       userJson += "lockedThreatLevel" -> JsNumberOrNull(user.lockedThreatLevel.map(_.toInt))
 
       anyStats foreach { stats =>
-        userJson += "anyUserStats" -> JsUserStats(stats, isStaffOrSelf = true, reqrPerms)
+        userJson += "anyUserStats" -> JsUserStats(stats, reqrPerms,
+              callerIsStaff = callerIsStaff, callerIsAdmin = callerIsAdmin,
+              callerIsUserHerself = callerIsUserHerself,
+              maySeePresence = maySeePresence, sensitiveAnonDisc = sensitiveAnonDisc)
       }
     }
 
@@ -423,26 +435,18 @@ object JsX {   RENAME // to JsonPaSe
   /** [Dupl_perms] Nowadays, could be enough with reqrPerms — and remove
     * callerIsAdmin/Staff?
     */
-  def JsUserStats(stats: UserStats, isStaffOrSelf: Bo, reqrPerms: Opt[EffPatPerms]): JsObject = {
+  def JsUserStats(stats: UserStats, reqrPerms: Opt[EffPatPerms],
+          callerIsStaff: Bo = false, callerIsAdmin: Bo,
+          callerIsUserHerself: Bo = false,
+          maySeePresence: Bo, sensitiveAnonDisc: Bo,
+          ): JsObject = {
     val tourTipsIds: immutable.Seq[String] = stats.tourTipsSeen getOrElse Nil
     var result = Json.obj(
       "userId" -> stats.userId,
-      "lastSeenAt" -> JsWhenMs(stats.lastSeenAt),
-      "lastPostedAt" -> JsWhenMsOrNull(stats.lastPostedAt),
-      "firstSeenAt" -> JsWhenMs(stats.firstSeenAtOr0),
-      "firstNewTopicAt" -> JsWhenMsOrNull(stats.firstNewTopicAt),
-      "firstDiscourseReplyAt" -> JsWhenMsOrNull(stats.firstDiscourseReplyAt),
-      "firstChatMessageAt" -> JsWhenMsOrNull(stats.firstChatMessageAt),
-      "numDaysVisited" -> stats.numDaysVisited,
-      "numSecondsReading" -> stats.numSecondsReading,
-      "numDiscourseRepliesRead" -> stats.numDiscourseRepliesRead,
       "numDiscourseRepliesPosted" -> stats.numDiscourseRepliesPosted,
-      "numDiscourseTopicsEntered" -> stats.numDiscourseTopicsEntered,
       "numDiscourseTopicsRepliedIn" -> stats.numDiscourseTopicsRepliedIn,
       "numDiscourseTopicsCreated" -> stats.numDiscourseTopicsCreated,
-      "numChatMessagesRead" -> stats.numChatMessagesRead,
       "numChatMessagesPosted" -> stats.numChatMessagesPosted,
-      "numChatTopicsEntered" -> stats.numChatTopicsEntered,
       "numChatTopicsRepliedIn" -> stats.numChatTopicsRepliedIn,
       "numChatTopicsCreated" -> stats.numChatTopicsCreated,
       "numLikesGiven" -> stats.numLikesGiven,
@@ -450,12 +454,37 @@ object JsX {   RENAME // to JsonPaSe
       "numSolutionsProvided" -> stats.numSolutionsProvided,
       )
 
-    if (isStaffOrSelf) {
+    if (maySeePresence || callerIsStaff) {
+      result += "lastPostedAt" -> JsWhenMsOrNull(stats.lastPostedAt)
+    }
+
+    // Let's skip, if only `callerIsUserHerself` but not `maySeePresence`?
+    // Otherwise looks as if *others* can see one's own presence too, if one can see
+    // it oneself.  And, lost of fields here can help others guess who an
+    // anonym is, e.g. an anon comment gets posted, and only one person has
+    // `lastSeenAt` showing a-few-seconds-ago. [deanon_risk]
+    // Later: Include only dates after when presence got enabled. [see_presence_start_date]
+    if (maySeePresence) {
+      result += "lastSeenAt" -> JsWhenMs(stats.lastSeenAt)
+      result += "firstSeenAt" -> JsWhenMs(stats.firstSeenAtOr0)
+      result += "firstNewTopicAt" -> JsWhenMsOrNull(stats.firstNewTopicAt)
+      result += "firstDiscourseReplyAt" -> JsWhenMsOrNull(stats.firstDiscourseReplyAt)
+      result += "firstChatMessageAt" -> JsWhenMsOrNull(stats.firstChatMessageAt)
+      result += "numDaysVisited" -> JsNumber(stats.numDaysVisited)
+      result += "numSecondsReading" -> JsNumber(stats.numSecondsReading)
+      result += "numDiscourseRepliesRead" -> JsNumber(stats.numDiscourseRepliesRead)
+      result += "numDiscourseTopicsEntered" -> JsNumber(stats.numDiscourseTopicsEntered)
+      result += "numChatMessagesRead" -> JsNumber(stats.numChatMessagesRead)
+      result += "numChatTopicsEntered" -> JsNumber(stats.numChatTopicsEntered)
+    }
+
+    // These can be used to guess who an anonym is. E.g. anonymity tour not seen,
+    // then, an anonymous comment appears and a person's anonymity related tour
+    // changes to seen. Or someone replies to an anonymous comment, and another
+    // user's `lastEmailedAt` changes — did that other user get a notification
+    // email, and is thus the author of the anon comment? [deanon_risk]
+    if (callerIsStaff && !sensitiveAnonDisc || callerIsUserHerself) {
       result += "tourTipsSeen" -> JsArray(tourTipsIds.map(JsString))
-      // Be careful with revealing this — in a small forum, could reveal who
-      // an anonym is (if you reply, and immediately lastEmailedAt changes,
-      // for a person you suspected was the anonym — indicating that hen got
-      // a reply notification). [deanon_risk]
       result += "lastEmailedAt" -> JsWhenMsOrNull(stats.lastEmailedAt)
       result += "lastSummaryEmailAt" -> JsWhenMsOrNull(stats.lastSummaryEmailAt)
       result += "nextSummaryEmailAt" -> JsWhenMsOrNull(stats.nextSummaryEmailAt)
diff --git a/appsv/server/talkyard/server/http/PlainApiActions.scala b/appsv/server/talkyard/server/http/PlainApiActions.scala
index 58b1ec845..3c28d8505 100644
--- a/appsv/server/talkyard/server/http/PlainApiActions.scala
+++ b/appsv/server/talkyard/server/http/PlainApiActions.scala
@@ -187,7 +187,7 @@ class PlainApiActions(
       // but reading, e.g. saving a reply. That is, throw for all POST request. Except for
       // logout or login, so people can login and read (OpenAuth login is GET only).
       import controllers.routes
-      def logoutPath: St = routes.LoginController.logout(None).url
+      def logoutPath: St = routes.LoginController.logout_get_post(None).url
       def loginPasswordPath: St = routes.LoginWithPasswordController.login.url
       def planMaintenancePath: St = routes.SuperAdminController.apiV0_planMaintenance.url
       if (globals.anyMaintWork.isDefined && request.method == "POST"
diff --git a/appsv/server/talkyard/server/pubsub/PubSub.scala b/appsv/server/talkyard/server/pubsub/PubSub.scala
index eef9c6b2f..d332a651e 100644
--- a/appsv/server/talkyard/server/pubsub/PubSub.scala
+++ b/appsv/server/talkyard/server/pubsub/PubSub.scala
@@ -509,6 +509,10 @@ class PubSubActor(val globals: Globals) extends Actor {
         newPresence: Presence): Unit = {
     COULD_OPTIMIZE // send just 1 WebSocket message, list many users. (5JKWQU01)
     val siteDao = globals.siteDao(siteId)
+    val settings = siteDao.getWholeSiteSettings()
+    if (!settings.enablePresence)
+      return
+
     users foreach { user =>
       val isActive = redisCacheForSite(siteId).isUserActive(user.id)
       if (isActive && newPresence != Presence.Active ||
@@ -522,6 +526,10 @@ class PubSubActor(val globals: Globals) extends Actor {
   private def publishPresenceAlways(siteId: SiteId, users: Iterable[Participant], newPresence: Presence): Unit = {
     COULD_OPTIMIZE // send just 1 WebSocket message, list many users. (5JKWQU01)
     val siteDao = globals.siteDao(siteId)
+    val settings = siteDao.getWholeSiteSettings()
+    if (!settings.enablePresence)
+      return
+
     users foreach { user =>
       publishPresenceImpl(siteDao, user, newPresence)
     }
@@ -539,12 +547,15 @@ class PubSubActor(val globals: Globals) extends Actor {
     traceLog(siteId, s"Pupl presence ${user.nameHashId}: $presence [TyDPRESCNS]")
 
     // If some time later, users can be "invisible", stop publishing their
-    // presence here.  [PRESPRIV]
+    // presence here.  [PRESPRIV]  [private_pats]
     // Compare with pages one may not see: [WATCHSEC].
 
     val tags = siteDao.getTags(forPat = Some(user.id))
     val tagTypes = siteDao.getTagTypes(tags.map(_.tagTypeId).toSet)
 
+    val settings = siteDao.getWholeSiteSettings()
+    dieIf(!settings.enablePresence, "TyEPRESENCE0382")
+
     sendWebSocketMessage(siteId, toUserIds, "presence", Json.obj( // ts: UserPresenceWsMsg
           "user" -> JsX.JsUser(user, tags),
           "presence" -> presence.toInt,
diff --git a/appsv/server/talkyard/server/pubsub/SubscriberController.scala b/appsv/server/talkyard/server/pubsub/SubscriberController.scala
index 9a5148687..7ceeaccfc 100644
--- a/appsv/server/talkyard/server/pubsub/SubscriberController.scala
+++ b/appsv/server/talkyard/server/pubsub/SubscriberController.scala
@@ -213,10 +213,20 @@ class SubscriberController @Inject()(cc: ControllerComponents, tyCtx: TyContext)
 
 
 
-  COULD // change rate limits — isn't expensive any more? Cached.
-  def loadOnlineUsers(): Action[U] = GetActionRateLimited(RateLimits.ExpensiveGetRequest) {
-        request =>
-    val stuff = request.dao.getUsersOnlineStuff()
+   // Not in use, for now. [0_load_onl_users]
+   private def loadOnlineUsers(): Action[U] = GetActionRateLimited(RateLimits.ReadsFromCacheALot) { req =>
+    unimpl("TyE603FKLT5")
+    import req.dao
+
+    // The client should look at the settings, and not have sent the request.
+    // (But when disabling presence, some clients might not notice immediately
+    // and try to load online users anyway. A race. That's why this is a "TyM..."
+    // not a "TyE..." response, that is, a message not an error.  [settings_race])
+    val settings = dao.getWholeSiteSettings()
+    throwForbiddenIf(!settings.enablePresence,
+        "TyM0PRESENCE", "Can't see who's online: Presence feature disabled")  // TyM(essage)
+
+    val stuff = dao.getUsersOnlineStuff()
     OkSafeJson(
       Json.obj(
         "numOnlineStrangers" -> stuff.numStrangers,
diff --git a/appsv/server/talkyard/server/sitepatch/SitePatchMaker.scala b/appsv/server/talkyard/server/sitepatch/SitePatchMaker.scala
index c0d9a0696..26932cc8c 100644
--- a/appsv/server/talkyard/server/sitepatch/SitePatchMaker.scala
+++ b/appsv/server/talkyard/server/sitepatch/SitePatchMaker.scala
@@ -176,10 +176,14 @@ object SitePatchMaker {
         anyDump.map(_.users) getOrElse tx.loadAllUsersInclDetails().filter(!_.isBuiltIn)
       fields("members") = JsArray(   // [dump] [exp] RENAME to "users', upd e2e tests
         users.map(JsUserInclDetails(
-          _, groups = Nil, usersById = Map.empty, callerIsAdmin = true, inclPasswordHash = true)))
+              _, groups = Nil, usersById = Map.empty, callerIsAdmin = true,
+              maySeePresence = true, sensitiveAnonDisc = false,
+              inclPasswordHash = true)))
 
       val pptStats: Seq[UserStats] = anyDump.map(_.pptStats) getOrElse tx.loadAllUserStats()
-      fields("ppStats") = JsArray(pptStats.map(JsUserStats(_, isStaffOrSelf = true, reqrPerms = None)))
+      fields("ppStats") = JsArray(pptStats.map(JsUserStats(_, reqrPerms = None,
+              callerIsStaff = true, callerIsAdmin = true,
+              maySeePresence = true, sensitiveAnonDisc = false)))
 
       val pptVisitStats: Seq[UserVisitStats] =
         anyDump.map(_.pptVisitStats) getOrElse tx.loadAllUserVisitStats()
diff --git a/client/app-more/forum/create-category-dialog.more.ts b/client/app-more/forum/create-category-dialog.more.ts
index 2a2c7b82f..f521c8249 100644
--- a/client/app-more/forum/create-category-dialog.more.ts
+++ b/client/app-more/forum/create-category-dialog.more.ts
@@ -433,7 +433,7 @@ const CatSettings = createClassAndFactory({
       r.div({ className: 'form-group' },
         r.label({ className: 'control-label', style: { display: 'block' }},
           "Purpose:"),
-        debiki2.widgets.AnonPurposeBtn({ cat: category, store,
+        debiki2.widgets.AnonPurposeBtn({ cat: category, store,  // [anon_purp_per_cat]
             layoutFor: LayoutFor.PageNoTweaks,
             onSelect: (newProps: DiscPropsSource) => {
               this.props.updateCategory(newProps);
diff --git a/client/app-more/forum/create-category-dialog.styl b/client/app-more/forum/create-category-dialog.styl
index 9e82615e7..d0d9edd33 100644
--- a/client/app-more/forum/create-category-dialog.styl
+++ b/client/app-more/forum/create-category-dialog.styl
@@ -43,6 +43,12 @@
   .form-group:not(:last-child)
     margin-right: 3em;
 
+.c_AnonPurpB.n_Dis
+  opacity: 0.8;
+
+.c_AnonPurpB_HowEna
+  font-style: italic;
+
 .s_CD_Dd
   margin-bottom: 20px;
   p
diff --git a/client/app-more/login/login-dialog.more.ts b/client/app-more/login/login-dialog.more.ts
index 3c49c48a5..e1c3765ac 100644
--- a/client/app-more/login/login-dialog.more.ts
+++ b/client/app-more/login/login-dialog.more.ts
@@ -30,6 +30,13 @@ const ModalBody = rb.ModalBody;
 const ModalFooter = rb.ModalFooter;
 
 
+export function isSocialLoginEnabled(settings: SettingsVisibleClientSide | Settings): Bo {
+  const ss = settings;
+  return ss.enableGoogleLogin || ss.enableFacebookLogin || ss.enableTwitterLogin ||
+        ss.enableGitHubLogin || ss.enableLinkedInLogin;
+}
+
+
 let loginDialog;
 
 
@@ -541,9 +548,7 @@ const LoginDialogContent = createClassAndFactory({
     //const customIdpBtnFirst = !customIdp ? false :
     //        customIdp.guiOrder < 0;  // undef < 0  is false
 
-    const anyOpenAuth = customIdps.length || ss.enableGoogleLogin ||
-        ss.enableFacebookLogin || ss.enableTwitterLogin || ss.enableGitHubLogin ||
-        ss.enableLinkedInLogin;
+    const anyOpenAuth = customIdps.length || isSocialLoginEnabled(ss);
 
     const canUseCustomIdps = ss.customIdps?.length;
     const useOnlyCustomIdps = ss.useOnlyCustomIdps && canUseCustomIdps;
@@ -572,19 +577,65 @@ const LoginDialogContent = createClassAndFactory({
             loggedInButMayNotAccess);
     }
     else {
-      content = rFragment({},
+      let customHtml: RElm | NU = null;
+      const anyConf: AuthnDiagConfV0 | NU = store.authnDiagConf?.c0[0];
+      const anyIntro = anyConf && (anyConf.headerText || anyConf.introHtml || anyConf.imageUrl);
+      const isStaffSpace = location.pathname.startsWith(UrlPaths.AdminArea)
+
+      // If logging in to the admin area, ignore any login dialog custom html, so any
+      // cutom html bugs won't prevent admins from logging in and fixing the bugs.
+      if (anyIntro && !isStaffSpace) {
+        // (Below, 'AuD_Cu' = "_Au_thentication _D_ialog _Cu_stomization".)
+        customHtml = r.div({ className: 'c_AuD_Cu' },
+            // If you want some HTML elements in the title, e.g. <h1>...</h1><h2>..</h2>  or <b>,
+            // you can leave headerText empty, and place the title in introHtml instead.
+            !anyConf.headerText ? null :
+                r.h1({ className: 'c_AuD_Cu_Ttl' }, anyConf.headerText),
+            !anyConf.introHtml ? null :
+                r.div({ className: 'c_AuD_Cu_Intro',
+                    // Only admins can edit this html.
+                    dangerouslySetInnerHTML: { __html: anyConf.introHtml }}),
+            !anyConf.imageUrl ? null :
+                r.figure({ className: 'c_AuD_Cu_Fig' }, r.img({ src: anyConf.imageUrl })),
+            );
+      }
+
+      const confOr = (custom: St | U, def: St): St | N => {
+        if (isStaffSpace || !custom) return def;
+        if (custom === '-') return null;  // [dash_hides_label]
+        return custom;
+      }
+
+      const conf = anyConf || {};
+
+      // "Continue with" converts better than "Sign Up" or "Log In", says
+      // Facebook's brand guidelines.
+      const continueWithDots: St = confOr(conf.continueWithCta, t.ld.ContinueWithDots);
+
+      const orCreateAccountOrLogIn: St | N =
+        isForFirstOwner || isSignUp && !allowLocalSignup ? null : (
+          anyOpenAuth
+              ? (isSignUp
+                  ? (isGuestSignUp ? confOr(conf.orTypeGuestNameCta, t.ld.OrTypeName) :
+                        confOr(conf.orCreateAcctCta, t.ld.OrCreateAcctHere))
+                  : confOr(conf.orLogInCta, t.ld.OrLogIn))
+              : (isSignUp
+                  ? (isGuestSignUp ? confOr(conf.guestNameCta, t.ld.YourNameQ) :
+                        confOr(conf.signUpCta, t.ld.SignUp))
+                  : confOr(conf.logInCta, t.ld.LogIn)));
+
+      content = rFr({},
         becomeOwnerInstructions,
-        !anyOpenAuth ? null : rFragment({},
-          r.p({ id: 'dw-lgi-or-login-using' },
-            // "Continue with" converts better than "Sign Up" or "Log In", says
-            // Facebook's brand guidelines.
-            t.ld.ContinueWithDots),
+        customHtml,
+        !anyOpenAuth ? null : rFr({},
+          !continueWithDots ? null : r.p({ id: 'dw-lgi-or-login-using' },
+              continueWithDots),
           r.div({ id: 'dw-lgi-other-sites' },
             //customIdpBtnFirst && customOidcBtns,
             !ss.enableGoogleLogin ? null :
                 ExtIdpAuthnBtn(makeAuthnProps('icon-google', 'Google')),
             !ss.enableFacebookLogin ? null :
-                ExtIdpAuthnBtn(makeAuthnProps('icon-facebook', 'Facebook', rFragment({},
+                ExtIdpAuthnBtn(makeAuthnProps('icon-facebook', 'Facebook', rFr({},
                   // Need to follow Facebook's brand guidelines. [FBBRAND]
                   FacebookLogoImage, "Facebook"))),
             /* Twitter login won't work, until they support OAuth2. [0_twitter_aun]
@@ -601,15 +652,8 @@ const LoginDialogContent = createClassAndFactory({
             // OpenID 1.0 since long gone, so skip:  icon-yahoo Yahoo!
             )),
 
-        isForFirstOwner || isSignUp && !allowLocalSignup ? null : (
-          r.p({ id: 'dw-lgi-or-login-using' },
-            anyOpenAuth
-              ? (isSignUp
-                  ? (isGuestSignUp ? t.ld.OrTypeName : t.ld.OrCreateAcctHere)
-                  : t.ld.OrLogIn)
-              : (isSignUp
-                  ? (isGuestSignUp ? t.ld.YourNameQ : t.ld.SignUp)
-                  : t.ld.LogIn))),
+        !orCreateAccountOrLogIn ? null : r.p({ id: 'dw-lgi-or-login-using' },
+            orCreateAccountOrLogIn),
 
         // Either:
         switchToLoginOrGuestDlg,
diff --git a/client/app-more/login/login-dialog.styl b/client/app-more/login/login-dialog.styl
index 7903fcd9a..bbade98c4 100644
--- a/client/app-more/login/login-dialog.styl
+++ b/client/app-more/login/login-dialog.styl
@@ -209,4 +209,29 @@
   z-index: 9999;
   opacity: 0.5;
 
+
+// Custom title and intro html
+
+.c_AuD_Cu
+   text-align: center;
+
+.c_AuD_Cu_Ttl
+  font-size: 25px;
+  margin-bottom: 1ex;
+  line-height: 140%;
+
+.c_AuD_Cu_Intro
+  max-width: 27em;
+  margin: 0 auto 30px;
+  &, p, ol, ul
+    color: hsl(0 0% 20%);  // [login_intro_color]
+    font-size: 16px;
+    line-height: 145%;
+
+.c_AuD_Cu_Fig img
+  padding: 0 40px;
+  margin: 30px auto;
+
+
+
 // vim: fdm=marker et ts=2 sw=2 fo=tcqwn list
diff --git a/client/app-more/login/login.styl b/client/app-more/login/login.styl
index dc574696f..fd5a51f65 100644
--- a/client/app-more/login/login.styl
+++ b/client/app-more/login/login.styl
@@ -40,6 +40,12 @@
   max-width: 300px
   margin: 23px auto 16px;
 
+// If the intro text, which is a bit lighter, is above, it looks better if "Continue with ..."
+// also is a bit lighter. So, then, change from the default (pretty black) to the below.
+// (But if there's no intro text, then it's nice if "Continue with ..." is stronger (blacker).)
+.c_AuD_Cu + #dw-lgi-or-login-using
+  color: hsl(0 0% 17%);  // a tiny bit darker than the [login_intro_color]
+
 #dw-lgi-other-sites
   text-align: center
 
diff --git a/client/app-more/more-bundle-already-loaded.d.ts b/client/app-more/more-bundle-already-loaded.d.ts
index 5978a9f0f..b0df9e22d 100644
--- a/client/app-more/more-bundle-already-loaded.d.ts
+++ b/client/app-more/more-bundle-already-loaded.d.ts
@@ -115,7 +115,7 @@ declare namespace debiki2.edithistory {
 declare namespace debiki2.login {
 
   function getLoginDialog(): AuthnDlgIf;
-
+  function isSocialLoginEnabled(settings: SettingsVisibleClientSide | Settings): Bo;
 }
 
 
diff --git a/client/app-more/users/user-summary.more.ts b/client/app-more/users/user-summary.more.ts
index 51996eec6..9dd81745f 100644
--- a/client/app-more/users/user-summary.more.ts
+++ b/client/app-more/users/user-summary.more.ts
@@ -34,29 +34,27 @@ export const UserSummary = createFactory({
     if (!stats)
       return r.p({}, "This user's statistics is not publicly visible.");
 
+    function mkStat(val: Nr | NU, text: St | RElm, isDuration?: Bo): RElm | N {
+      if (!isVal(val)) return null;
+      const valStr = isDuration ? moment.duration({ seconds: val }).humanize() : val;
+      return r.li({ className: 's_UP_Stats_Stat' }, valStr, text);
+    }
+
     return (
      r.div({ className: 's_UP_Act_Stats' },
        r.h2({}, "Statistics"),
        r.ul({},
-         r.li({ className: 's_UP_Stats_Stat' },
-           stats.numDaysVisited + " days visited"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           moment.duration({ seconds: stats.numSecondsReading }).humanize() + " spent reading"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           userStats_totalNumPostsRead(stats) + " posts read"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           stats.numLikesGiven + " likes given"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           stats.numLikesReceived + " likes received"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           (stats.numChatTopicsCreated + stats.numDiscourseTopicsCreated) + " topics created"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           stats.numDiscourseRepliesPosted + " replies posted"),
-         r.li({ className: 's_UP_Stats_Stat' },
-           stats.numChatMessagesPosted + " chat messages posted"),
-         !stats.numSolutionsProvided ? null : r.li({ className: 's_UP_Stats_Stat' },
-           stats.numSolutionsProvided + " solutions ",
-             r.span({ className: 'icon-ok-circled' })))));
+         mkStat(stats.numDaysVisited, " days visited"),
+         mkStat(stats.numSecondsReading, " spent reading", true),
+         mkStat(userStats_totalNumPostsRead(stats), " posts read"),
+         mkStat(stats.numLikesGiven, " likes given"),
+         mkStat(stats.numLikesReceived, " likes received"),
+         mkStat(stats.numChatTopicsCreated + stats.numDiscourseTopicsCreated, " topics created"),
+         mkStat(stats.numDiscourseRepliesPosted, " replies posted"),
+         mkStat(stats.numChatMessagesPosted, " chat messages posted"),
+         !stats.numSolutionsProvided ? null : mkStat(
+              stats.numSolutionsProvided,
+              rFr({}, " solutions ", r.span({ className: 'icon-ok-circled' }))))));
   }
 });
 
diff --git a/client/app-more/users/users-page.more.ts b/client/app-more/users/users-page.more.ts
index 9b7b4a508..65808099a 100644
--- a/client/app-more/users/users-page.more.ts
+++ b/client/app-more/users/users-page.more.ts
@@ -429,7 +429,7 @@ const PatTopPanel = createComponent({
     const store: Store = props.store;
     const user: UserDetailsStatsGroups = props.user;
     const groupsMaySee: Group[] = props.groupsMaySee;
-    const stats: UserStats | undefined = props.stats;
+    const stats: UserStats | NU = props.stats;
     const me: Myself = props.me;
     const isGone = user_isGone(user);
 
@@ -524,6 +524,8 @@ const PatTopPanel = createComponent({
     const groupList = GroupList(
         user, groupsMaySee, 's_UP_Ab_Stats_Stat_Groups_Group');
 
+    const totNumPosts: Nr | N = user.isGroup ? null : userStats_totalNumPosts(stats);
+
     // COULD prefix everything inside with s_UP_Ab(out) instead of just s_UP.
     return r.div({ className: 's_UP_Ab dw-user-bar clearfix' },
       // This + display: table-row makes the avatar image take less space,
@@ -545,14 +547,18 @@ const PatTopPanel = createComponent({
           suspendedInfo,
           deletedInfo)),
         !stats ? null : r.div({ className: 's_UP_Ab_Stats' },
-          r.div({ className: 's_UP_Ab_Stats_Stat' },
+          !stats.firstSeenAt ? null : r.div({ className: 's_UP_Ab_Stats_Stat' },
             t.upp.JoinedC + moment(stats.firstSeenAt).fromNow()),
-          r.div({ className: 's_UP_Ab_Stats_Stat' },user.isGroup ? null :
-            t.upp.PostsMadeC + userStats_totalNumPosts(stats)),
+
+          !totNumPosts ? null : r.div({ className: 's_UP_Ab_Stats_Stat' },
+            t.upp.PostsMadeC + totNumPosts),
+
           !stats.lastPostedAt ? null : r.div({ className: 's_UP_Ab_Stats_Stat' },
             t.upp.LastPostC + moment(stats.lastPostedAt).fromNow()),
-          r.div({ className: 's_UP_Ab_Stats_Stat' },
+
+          !stats.lastSeenAt ? null : r.div({ className: 's_UP_Ab_Stats_Stat' },
             t.upp.LastSeenC + moment(stats.lastSeenAt).fromNow()),
+
           r.div({ className: 's_UP_Ab_Stats_Stat' },
             t.GroupsC,
             r.ul({ className: 's_UP_Ab_Stats_Stat_Groups' },
diff --git a/client/app-more/widgets/anon-purpose-btn.more.ts b/client/app-more/widgets/anon-purpose-btn.more.ts
index 8a7f5c407..6d91575b6 100644
--- a/client/app-more/widgets/anon-purpose-btn.more.ts
+++ b/client/app-more/widgets/anon-purpose-btn.more.ts
@@ -31,10 +31,29 @@ export const AnonPurposeBtn = React.createFactory<DiscLayoutDropdownBtnProps>(
         function(props: DiscLayoutDropdownBtnProps) {
 
   const derived: NodePropsDerivedAndDefault = node_deriveLayout(props);
+  const newAnonStatus = derived.actualLayout.newAnonStatus;
+
+  // Is the currently choosen option _enabled? (Might not be, if `settings.enableAnonSens`
+  // gets disabled, when there are *already* anon cats. [_active_and_disabled])
+  const btnEnabled: Bo =
+          // For anonymous sensitive discussions. Needs to be enabled explicitly,
+          // since disables the presence feature. [anon_sens_0_presence]
+          newAnonStatus === AnonStatus.IsAnonOnlySelfCanDeanon &&
+              props.store.settings.enableAnonSens ||
+          // For ideation. Always enabled.
+          newAnonStatus === AnonStatus.IsAnonCanAutoDeanon;
+          // Sth else? Will be disabled — then, should notice it needs to be added here.
+
+  const titleDescr = anonPurpose_title(newAnonStatus, btnEnabled);
+  const howEnable: St | RElm | NU = titleDescr[1];
+  const disabledClass = btnEnabled ? '' : ' n_Dis';
+  const crossClass = btnEnabled ? '' : 'c_Cross';
+  const btnTitle = r.span({ className: crossClass },
+          titleDescr[0], ' ', r.span({ className: 'caret' }));
 
   // Bit dupl code. [node_props_btn]
-  return (
-      Button({ className: 'e_AnonPurpB', onClick: (event: MouseEvent) => {
+  return rFr({},
+      Button({ className: 'c_AnonPurpB' + disabledClass, onClick: (event: MouseEvent) => {
           const atRect = cloneEventTargetRect(event);
           openAnonPurposeDiag({
               atRect,
@@ -46,28 +65,44 @@ export const AnonPurposeBtn = React.createFactory<DiscLayoutDropdownBtnProps>(
               // These forSth just affect the dialog title.
               forCat: !!props.cat,
               forEveryone: props.forEveryone, // not needed actually
+              // Should the anon sensitive discussions option be _enabled in the dropdown?
+              enableAnonSens: props.store.settings.enableAnonSens,
               onSelect: props.onSelect });
         }},
-        anonPurpose_title(derived.actualLayout.newAnonStatus),
-            ' ', r.span({ className: 'caret' })));
+        btnTitle),
+      howEnable && r.div({ className: 'c_AnonPurpB_HowEna' }, howEnable));
 });
 
 
 
-function anonPurpose_title(neverAlways: AnonStatus): St {
+// Returns  [title, howEnable]  where howEnable explains how to enable this option,
+// if it's not currently enabled.
+//
+function anonPurpose_title(neverAlways: AnonStatus, enabled: Bo): [St, St | RElm | NU] {
+  let title: St | U;
+  let howEnable: St | RElm | NU;
   switch (neverAlways) {
-    case AnonStatus.IsAnonOnlySelfCanDeanon: return "Sensitive discussions";
-    case AnonStatus.IsAnonCanAutoDeanon: return "Better ideas & decisions";
+    case AnonStatus.IsAnonOnlySelfCanDeanon:
+      title = "Sensitive discussions";
+      howEnable = rFr({},
+          "You need to enable the Anonymous Sensitive Discussions site feature, ",
+          r.a({ href: linkToAdminPageFeatures(), target: 'blank' }, "here."));
+      break;
+    case AnonStatus.IsAnonCanAutoDeanon:
+      title = "Better ideas & decisions";
+      // howEnable — always enabled, if anon comments possible.
+      break;
     default:
-      return `Bad: ${neverAlways} TyEANONPURP`;
+      return [`Bad: ${neverAlways} TyEANONPURP`, null];
   }
+  return [title, enabled ? null : howEnable];
 }
 
 
 // Can rewrite the neverAlways diag to use proxy diag too,  [anon_purpose_proxy_diag]
 // like below.
 //
-function openAnonPurposeDiag(ps: DiscLayoutDiagState) {
+function openAnonPurposeDiag(ps: DiscLayoutDiagState & { enableAnonSens?: Bo }) {
   morekit.openProxyDiag({ atRect: ps.atRect, flavor: DiagFlavor.Dropdown,
               dialogClassName: 'e_AnonPurpD' },
       (closeDiag) => {
@@ -80,19 +115,22 @@ function openAnonPurposeDiag(ps: DiscLayoutDiagState) {
 
     diagTitle = r.div({ className: 's_ExplDrp_Ttl' }, "Purpose");
 
-    sensitiveItem = makeItem(AnonStatus.IsAnonOnlySelfCanDeanon, 'e_OnlSelf');
-    betterIdeasItem = makeItem(AnonStatus.IsAnonCanAutoDeanon, 'e_AutoDean');
+    sensitiveItem = makeItem(AnonStatus.IsAnonOnlySelfCanDeanon, 'e_OnlSelf', ps.enableAnonSens);
+    betterIdeasItem = makeItem(AnonStatus.IsAnonCanAutoDeanon, 'e_AutoDean', true);
 
-    function makeItem(itemValue: AnonStatus, e2eClass: St): RElm {
-      let active: Bo;
-      let title: St | RElm;
-      active = itemValue === layout.newAnonStatus;
-      title = anonPurpose_title(itemValue);
+    function makeItem(itemValue: AnonStatus, e2eClass: St, enabled: Bo): RElm {
+      const [title, anyExpl] = anonPurpose_title(itemValue, enabled);
+      const active = itemValue === layout.newAnonStatus;
+      const crossClass = enabled ? '' : 'c_Cross ';
 
       return ExplainingListItem({
+            // Can be both _active_and_disabled — if was IsAnonOnlySelfCanDeanon, but
+            // then an admin disabled the enableAnonSens feature. Then, the server
+            // should [reject_anon_sensitive_posts].
             active,
-            title: r.span({ className: e2eClass  }, title),
-            // text: diagState.mkDescr(itemValue, diagState.default.from),
+            title: r.span({ className: crossClass + e2eClass }, title),
+            text: anyExpl,
+            disabled: !enabled,
             onSelect: () => {
               if (active) {
                 // Noop. Already using this setting.
diff --git a/client/app-slim/ReactStore.ts b/client/app-slim/ReactStore.ts
index 13e099bb0..565a02247 100644
--- a/client/app-slim/ReactStore.ts
+++ b/client/app-slim/ReactStore.ts
@@ -682,10 +682,12 @@ ReactStore.activateVolatileData = function() {
     }
   }
 
-  // Do the interesting thing
+  // Do the activation
   // ------------------------------
 
-  theStore_setOnlineUsers(volData.numStrangersOnline, volData.usersOnline);
+  if (volData.usersOnline) {
+    theStore_setOnlineUsers(volData.numStrangersOnline, volData.usersOnline);
+  }
 
   ReactStore.activateMyself(volData.me, volData.stuffForMe);
 
@@ -962,6 +964,9 @@ function addMyDraftPosts(store: Store, myPageData: MyPageData) {
 
 
 function theStore_setOnlineUsers(numStrangersOnline: number, usersOnline: BriefUser[]) {
+  // @ifdef DEBUG
+  dieIf(store.settings.enablePresence === false, 'TyEGOTPRESENCE'); // [presence_assertion]
+  // @endif
   store.numOnlineStrangers = numStrangersOnline;
   store.userIdsOnline = {};
   _.each(usersOnline, theStore_addOnlineUser);
diff --git a/client/app-slim/Server.ts b/client/app-slim/Server.ts
index 8fd51148b..ef94d9f5a 100644
--- a/client/app-slim/Server.ts
+++ b/client/app-slim/Server.ts
@@ -2535,11 +2535,13 @@ export function toggleTips(tips: { tipsId?: St, hide: Bo }) {
 }
 
 
+/* Not in use, for now.  [0_load_onl_users]
 export function loadOnlineUsers() {
+   TESTS_MIS SING:  Verify server won't reply, if presence disabled.
   get('/-/load-online-users', (response) => {
     ReactActions.updateOnlineUsersLists(response.numOnlineStrangers, response.onlineUsers);
   });
-}
+} */
 
 
 export function listSites() {
diff --git a/client/app-slim/links.ts b/client/app-slim/links.ts
index 07e1e1ca0..52f6cb9f8 100644
--- a/client/app-slim/links.ts
+++ b/client/app-slim/links.ts
@@ -75,6 +75,10 @@ export function linkToAdminPageLoginSettings(): string {
   return linkToAdminPage() + 'settings/login';
 }
 
+export function linkToAdminPageFeatures(): St {
+  return linkToAdminPage() + 'settings/features';
+}
+
 export function linkToAdminApi(): string {
   return linkToAdminPage() + 'api';
 }
diff --git a/client/app-slim/mixins.styl b/client/app-slim/mixins.styl
index 953f082b6..74ec26cf1 100644
--- a/client/app-slim/mixins.styl
+++ b/client/app-slim/mixins.styl
@@ -14,11 +14,16 @@ clearfix()
     clear both
 
 // Also see .s_Pg_DdX = an extra crossy cross, for the whole page.
+// SMALLER_BUNDLE: Use a CSS class instead of dupl this background, almost 300 bytes!
+// (Using `crossGray()` duplicates it.)  See .c_Cross below.
 crossGray()
   background: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' version='1.1' preserveAspectRatio='none' viewBox='0 0 100 100'><path d='M100 0 L0 100 ' stroke='%23555' stroke-width='1'/><path d='M0 0 L100 100 ' stroke='%23555' stroke-width='1'/></svg>");
   background-repeat:no-repeat;
   background-position:center center;
 
+.c_Cross
+  crossGray();
+
 // Old clearfix list: (could start using the above clearfix() instead)
 // Makes the root post wrap its (floating) children, don't know if
 // needed for other horizontal threads.
diff --git a/client/app-slim/model.ts b/client/app-slim/model.ts
index 23b5a549b..419838e8e 100644
--- a/client/app-slim/model.ts
+++ b/client/app-slim/model.ts
@@ -996,8 +996,8 @@ interface MaintWork {
 ///
 interface VolatileDataFromServer {
   maintWork?: MaintWork;
-  usersOnline: Pat[];
-  numStrangersOnline: Nr;
+  usersOnline: Pat[] | N;
+  numStrangersOnline: Nr | N;
   me?: Me;
   stuffForMe?: StuffForMe;
   // Sometimes, on embedded comments pages, privacy tools and settings remove cookies.  [NOCOOKIES]
@@ -1260,6 +1260,9 @@ interface Store extends Origins, DiscStore, PartialEditorStoreState {
   settings: SettingsVisibleClientSide;
   hideForumIntro?: boolean;
 
+  // Only present, if not logged in.
+  authnDiagConf?: AuthnDiagConf;
+
   // For all site sections, loaded lazily, and updated in a hacky way, for now, so have a look,
   // and refactor (?), before using it for anything more.
   allCategoriesHacky?: Category[];
@@ -1357,6 +1360,13 @@ interface SettingsVisibleClientSide extends TopicInterfaceSettings, SettingsDisc
   enableTags?: boolean;                 // default: false for now, true later when impl.
   enableChat?: boolean;                 // default: true
   enableDirectMessages?: boolean;       // default: true
+  enableAnonSens?: Bo                   // default: false
+
+  // Don't use directly — instead, check if `Store.userIdsOnline` and
+  // `VolatileDataFromServer.usersOnline` are null, to be sure they aren't
+  // accidentally included by the server. (Included only for a [presence_assertion].)
+  enablePresence?: Bo                   // default: true
+
   enableSimilarTopics?: boolean;        // default: depends on config file, later: true
   showSubCommunities?: boolean;         // default: false
   navConf?: BrowserCode;                // default: {}
@@ -2267,8 +2277,41 @@ interface PageTweaksStorePatch {
 }
 
 
+interface AuthnDiagConf {
+  // Config format version 0. Maybe that'll be enough forever.
+  // Let's use 'c0' not 'v0' so more unique.
+  c0?: AuthnDiagConfV0[]
+}
+
+
+interface AuthnDiagConfV0 {
+  // Later, could:
+  // langs: ['en_US', 'sv_SE' ...]  — use for these locales / languages
+  // maxWidth: 768  — if display at most this wide
+
+  headerText?: St
+  introHtml?: St
+  imageUrl?: St
+
+  // If OpenID configured, then, first: "Continue with ... [Google] [FB] [...]"
+  continueWithCta?: St
+  // Thereafter, one of:  "Or create account:"  /  "Or log in:".
+  orCreateAcctCta?: St
+  orLogInCta?: St
+  // If guest login enabled:  "Or type your name:"
+  orTypeGuestNameCta?: St
+
+  // If OpenID *not* configured, then, one of:  "Join" (or "Sign up")  /  "Log in".
+  signUpCta?: St
+  logInCta?: St
+  // If guest login enabled:  "Your name?"
+  guestNameCta?: St
+}
+
+
 interface Settings extends TopicInterfaceSettings, SettingsDiscPropsOldNames {
   // Signup and Login
+  authnDiagConf: AuthnDiagConf;
   expireIdleAfterMins: number;
   userMustBeAuthenticated: boolean;
   userMustBeApproved: boolean;
@@ -2371,6 +2414,8 @@ interface Settings extends TopicInterfaceSettings, SettingsDiscPropsOldNames {
   enableTags: boolean;
   enableChat: boolean;
   enableDirectMessages: boolean;
+  enableAnonSens: Bo
+  enablePresence: Bo
   enableSimilarTopics: boolean;
   enableCors: boolean;
   allowCorsFrom: String;
diff --git a/client/app-slim/oop-methods.ts b/client/app-slim/oop-methods.ts
index 5c2aac07b..6d31185fe 100644
--- a/client/app-slim/oop-methods.ts
+++ b/client/app-slim/oop-methods.ts
@@ -2215,14 +2215,18 @@ export function threatLevel_toElem(threatLevel: ThreatLevel) {
 // User stats
 //----------------------------------
 
-export function userStats_totalNumPosts(stats: UserStats): number {
+export function userStats_totalNumPosts(stats: UserStats | NU): Nr | N {
+  // Either _none_or_all.
+  if (!stats || !isVal(stats.numChatMessagesPosted)) return null;
   return stats.numChatMessagesPosted + stats.numChatTopicsCreated +
-      stats.numDiscourseRepliesPosted + stats.numDiscourseTopicsCreated;
+          stats.numDiscourseRepliesPosted + stats.numDiscourseTopicsCreated;
 }
 
-export function userStats_totalNumPostsRead(stats: UserStats): number {
+export function userStats_totalNumPostsRead(stats: UserStats | NU): Nr | N {
+  // Either _none_or_all should be present.
+  if (!stats || !isVal(stats.numChatMessagesRead)) return null;
   return stats.numChatMessagesRead + stats.numChatTopicsEntered +
-    stats.numDiscourseRepliesRead + stats.numDiscourseTopicsEntered;
+          stats.numDiscourseRepliesRead + stats.numDiscourseTopicsEntered;
 }
 
 
diff --git a/client/app-slim/sidebar/sidebar.ts b/client/app-slim/sidebar/sidebar.ts
index 9fb9486c7..95ab51d03 100644
--- a/client/app-slim/sidebar/sidebar.ts
+++ b/client/app-slim/sidebar/sidebar.ts
@@ -106,10 +106,7 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
     this.setState({
       store: newStore,
     });
-    if (newStore.isContextbarOpen && newStore.me.id &&
-        newStore.me.id !== this.state.lastLoadedOnlineUsersAsId) {
-      this.loadOnlineUsers();
-    }
+    this.maybeLoadOnlineUsers(newStore);
   },
 
   showRecent: function() {
@@ -159,9 +156,7 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
   componentDidMount: function() {
     const store: Store = this.state.store;
     keymaster('s', this.toggleSidebarOpen);
-    if (store.isContextbarOpen && this.state.lastLoadedOnlineUsersAsId !== store.me.id) {
-      this.loadOnlineUsers();
-    }
+    this.maybeLoadOnlineUsers();
   },
 
   componentWillUnmount: function() {
@@ -182,8 +177,21 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
     // if is-2d then: this.updateSizeAndPosition2d(event);
   },
 
-  loadOnlineUsers: function() {
-    const store: Store = this.state.store;
+  maybeLoadOnlineUsers: function(anyNewStore?: Store) {
+    const store: Store = anyNewStore || this.state.store;
+
+    // Online users list not visible, or disabled?
+    if (!store.isContextbarOpen || !store.userIdsOnline)
+      return;
+
+    // Not logged in? Then likely won't care who's online or not.
+    if (!store.me.id)
+      return;
+
+    // List already loaded?
+    if (store.me.id === this.state.lastLoadedOnlineUsersAsId)
+      return;
+
     this.setState({ lastLoadedOnlineUsersAsId: store.me.id });
     // Skip for now, because now I'm including all online users are included in the page html.
     //Server.loadOnlineUsers();
@@ -354,9 +362,21 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
 
     //var unreadBtnTitle = commentsFound ? 'Unread (' + commentsFound.unread.length + ')' : null;
     const starredBtnTitle = commentsFound ? `${t.Bookmarks} (${commentsFound.starred.length})` : null;
-    const usersBtnTitle = usersHere.areChatChannelMembers || usersHere.areTopicContributors
-        ? `${t.Users} (${numOnlineTextSlash + usersHere.users.length})`
-        : `${t.Users} (${usersHere.numOnline})`;
+
+    const specificPage = usersHere.areChatChannelMembers || usersHere.areTopicContributors;
+    const anyUsersBtnTitle: St | N = (
+        // If the presence feature is enabled, we'll include a num-online count.
+        store.userIdsOnline
+          ? (specificPage
+              // List users on current page, and indicate which ones are online?
+              ? `${t.Users} (${numOnlineTextSlash + usersHere.users.length})`
+              // List users in the whole forum, and indicate which ones are online?
+              : `${t.Users} (${usersHere.numOnline})`)
+          : (specificPage
+              // List users on current page, but without any is-online indicators.
+              ? t.Users
+              // List no users. Not a specific page, & presence disabled, don't know who's online.
+              : null));
 
     // COULD show a "Recent searches" on the search results page. Click a recent search, to
     // use it again.
@@ -395,12 +415,17 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
             this.onPostClick);
         break;
       case 'Users':
-        let numOnlineStrangers = store.numOnlineStrangers;
+        let numOnlineStrangers: Nr | N = store.numOnlineStrangers;
+        const seeOnlineDisabled = "See-online feature disabled."; // 0I18N, just temporary
         if (page.pageRole === PageRole.Forum) {
-          title = t.cb.UsersOnlineForum;
+          title = store.userIdsOnline ? t.cb.UsersOnlineForum :
+                    // Can happen when toggling off the presence feature? [settings_race]
+                    // UX: This isn't great, what to do instead when moving from one page to
+                    // another, but the currently selected tab doesn't "work" at the other page?
+                    seeOnlineDisabled;
         }
         else if (!usersHere.areChatChannelMembers && !usersHere.areTopicContributors) {
-          title = t.cb.UsersOnline;
+          title = store.userIdsOnline ? t.cb.UsersOnline : seeOnlineDisabled; // [settings_race]
         }
         else if (page.pageRole === PageRole.JoinlessChat) {
           // Then, list the most recent people who posted in the chat?
@@ -410,10 +435,10 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
         else {
           const titleText = isChat ? t.cb.UsersInThisChat : t.cb.UsersInThisTopic; // [users_here]
           title = r.div({},
-            titleText,
-            r.span({ className: 'esCtxbar_onlineCol' }, t.Online));
+              titleText,
+              store.userIdsOnline && r.span({ className: 'esCtxbar_onlineCol' }, t.Online));
           // Don't show num online strangers, when listing post authors for the current topic only.
-          numOnlineStrangers = 0;
+          numOnlineStrangers = null;
         }
         usersClass = ' active';
         listItems = makeUsersContent(store, usersHere.users, store.me.id, numOnlineStrangers);
@@ -508,9 +533,9 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
           recentButton,
           unreadButton,
           starredButton,
-          r.button({ className: 'e_CtxBarB btn btn-default' + usersClass,
+          anyUsersBtnTitle && r.button({ className: 'e_CtxBarB btn btn-default' + usersClass,
                 onClick: this.showUsers },
-              usersBtnTitle),
+              anyUsersBtnTitle),
           adminGuideButton);
     }
     else {
@@ -521,7 +546,7 @@ export var Sidebar = createComponent({  // RENAME to ContextBar
             recentButton,
             unreadButton,
             starredButton,
-            MenuItem({ onClick: this.showUsers }, usersBtnTitle),
+            anyUsersBtnTitle && MenuItem({ onClick: this.showUsers }, anyUsersBtnTitle),
             adminGuideButton));
     }
 
@@ -607,7 +632,7 @@ function makeCommentsContent(comments: Post[], currentPostNr: PostNr, store: Sto
 
 
 function makeUsersContent(store: Store, users: BriefUser[], myId: UserId,
-      numOnlineStrangers: number) {
+      numOnlineStrangers: Nr | N) {
   // List the current user first, then online users, then others.
   // COULD: list alphabetically, so one can scan and find one's friends by name easily
   users.sort((a, b) => {
@@ -625,14 +650,18 @@ function makeUsersContent(store: Store, users: BriefUser[], myId: UserId,
         r.span({ className: 'esPresence_thatsYou' }, ' — ' + t.cb.thatsYou) : null;
     currentUserIsStranger = currentUserIsStranger && user.id !== myId;
     const isUserOnline = store_isUserOnline(store, user.id);
-    const presenceClass = isUserOnline ? 'active' : 'away';
-    const presenceTitle = isUserOnline ? t.Active : t.Away;
+
+    // Presence feature enabled?
+    const presEna: Object | NU = store.userIdsOnline;
+    const presenceClass = !presEna ? '' : (isUserOnline ? 'esPresence-active' : 'esPresence-away');
     return (
-        r.div({ key: user.id, className: 'esPresence esPresence-' + presenceClass,
-            onClick: (event) => morebundle.openAboutUserDialog(user.id, event.target) },
+        r.div({ key: user.id, className: 'esPresence ' + presenceClass,
+            onClick: (event: MouseEvent) =>
+                morebundle.openAboutUserDialog(user.id, event.target) },
           avatar.AvatarAndName({ user, origins: store, ignoreClicks: true }),
           thatsYou,
-          r.span({ className: 'esPresence_icon', title: presenceTitle })));
+          presEna && r.span({ className: 'esPresence_icon',
+                          title: isUserOnline ? t.Active : t.Away })));
   });
 
   if (numOnlineStrangers) {
diff --git a/client/app-slim/slim-bundle.d.ts b/client/app-slim/slim-bundle.d.ts
index 4043932cf..4ea084a0b 100644
--- a/client/app-slim/slim-bundle.d.ts
+++ b/client/app-slim/slim-bundle.d.ts
@@ -481,6 +481,7 @@ declare namespace debiki2 {
   function linkToUsersEmailAddrs(userIdOrUsername: UserId | string): string;
   function linkToAdminPage(): string;
   function linkToAdminPageLoginSettings(): string;
+  function linkToAdminPageFeatures(): St;
   function linkToAdminApi(): string;
   function linkToAdminPageModerationSettings(): string;
   function linkToAdminPageEmbeddedSettings(): string;
@@ -607,8 +608,8 @@ declare namespace debiki2 {
   //}
 
   // From oop-methods.ts:
-  function userStats_totalNumPosts(stats: UserStats): number;
-  function userStats_totalNumPostsRead(stats: UserStats): number;
+  function userStats_totalNumPosts(stats: UserStats | NU): Nr | N;
+  function userStats_totalNumPostsRead(stats: UserStats | NU): Nr | N;
   function trustLevel_toString(trustLevel: TrustLevel): string;
 
 }
diff --git a/client/app-slim/store-getters.ts b/client/app-slim/store-getters.ts
index 894f4772f..fc7f1e975 100644
--- a/client/app-slim/store-getters.ts
+++ b/client/app-slim/store-getters.ts
@@ -125,7 +125,7 @@ export function store_getPageMembersList(store: Store): BriefUser[] {
 }
 
 
-export function store_getUsersOnThisPage(store: Store): BriefUser[] {
+function store_getUsersOnThisPage(store: Store): BriefUser[] {
   const page: Page = store.currentPage;
   const users: BriefUser[] = [];
   _.each(page.postsByNr, (post: Post) => {
@@ -139,7 +139,7 @@ export function store_getUsersOnThisPage(store: Store): BriefUser[] {
 }
 
 
-export function store_getUsersOnline(store: Store): BriefUser[] {
+function store_getUsersOnline(store: Store): BriefUser[] {
   const users = [];
   _.forOwn(store.userIdsOnline, (alwaysTrue, userIdString: string) => {
     let userId: UserId = parseInt(userIdString);
diff --git a/client/app-slim/topbar/topbar.ts b/client/app-slim/topbar/topbar.ts
index 481c0f4ef..f73018071 100644
--- a/client/app-slim/topbar/topbar.ts
+++ b/client/app-slim/topbar/topbar.ts
@@ -587,8 +587,9 @@ export const TopBar = createComponent({
     // We'll show "X users online", to encourage people to open and learn about the contextbar.
     // They'll more likely to do that, if they see a message that means "other people here too,
     // check them out".
-    let contextbarTipsDetailed;
-    let contextbarTipsBrief;
+    let contextbarTipsDetailed: St | U;
+    let contextbarTipsBrief: RElm | U;
+
     if (!usersHere) {
       // Server side — skip this. Or own data not yet activated – wait until later.
     }
@@ -601,18 +602,25 @@ export const TopBar = createComponent({
       // For now, show this dummy text, because otherwise people get confused when the
       // "X users online" text disappears:
       contextbarTipsDetailed = t.tb.RecentPosts;
-      contextbarTipsBrief = r.span({}, '0', r.span({ className: 'icon-comment-empty' }));
+      // Old: '0' — why did I include '0' (zero)? It was a placeholder for the
+      // number-of-comments? Let's skip, the icon can be enough for now.
+      contextbarTipsBrief = r.span({}, r.span({ className: 'icon-comment-empty' }));
+    }
+    else if (!store.userIdsOnline) {
+      // Presence disabled, we don't know how many are online. Just for now:
+      contextbarTipsBrief = r.span({}, r.span({ className: 'icon-comment-empty' }));
     }
     else {
       /* don't:
       var numOthers = usersHere.numOnline - (usersHere.iAmHere ? 1 : 0);
       because then people get confused when inside the contextbar they see: sth like '1 user, you'
       although when collapsed, says '0 users'. So for now: */
-      const numOthers = usersHere.numOnline;
+      const numOthers: Nr = usersHere.numOnline;
       const isChat = usersHere.areChatChannelMembers;
       contextbarTipsDetailed = numOthers + (isChat ? t.tb.NumOnlChat : t.tb.NumOnlForum);
       contextbarTipsBrief = r.span({}, '' + numOthers, r.span({ className: 'icon-user' }));
     }
+
     const contextbarTips = !contextbarTipsDetailed ? null :
         r.span({ className: 'esOpenCtxbarBtn_numOnline'},
           r.span({ className: 'detailed' }, contextbarTipsDetailed),
diff --git a/client/app-slim/util/ExplainingDropdown.styl b/client/app-slim/util/ExplainingDropdown.styl
index 4d5a62e0f..c5e64e62b 100644
--- a/client/app-slim/util/ExplainingDropdown.styl
+++ b/client/app-slim/util/ExplainingDropdown.styl
@@ -34,14 +34,15 @@ $sideSpace = 20px;
   cursor: pointer;
   border: 2px solid transparent;
 
-  a
+  & > a
     display: block;
     text-decoration: none;
-  a, button
+  & > a,
+  & > button
     padding: 9px $sideSpace;
     @media (max-width: 500px)
       padding-right: 0; // the DropModal has padding-right itself already [5YKF20]
-  button
+  & > button
     text-align: left; // else center
     border: none;
     background: none;
@@ -50,9 +51,11 @@ $sideSpace = 20px;
     background: hsl($uiHue, 100%, 97%);
     border: 2px solid hsl($uiHue, 100%, 78%);
 
-  &.c_Dis a
-    opacity: 0.5;
+  &.c_Dis
+    opacity: 0.74;
     cursor: default;
+    .esExplDrp_entry_title
+      display: inline-block; // otherwise cross too wide
 
 .esExplDrp_entry.active
   $bgColor = hsl($uiHue, 95%, 92%);
diff --git a/client/app-slim/util/ExplainingDropdown.ts b/client/app-slim/util/ExplainingDropdown.ts
index 2fd931739..703dd8898 100644
--- a/client/app-slim/util/ExplainingDropdown.ts
+++ b/client/app-slim/util/ExplainingDropdown.ts
@@ -61,7 +61,7 @@ export var ExplainingListItem = createComponent({
 
     // @ifdef DEBUG
     dieIf(isButton && isLink, 'TyEDBLACTN0356');
-    dieIf(!props.onClick && !props.onSelect && !props.linkTo, 'TyE0ACTN03825');
+    dieIf(!props.onClick && !props.onSelect && !props.linkTo && !props.disabled, 'TyE0ACTN03825');
     // @endif
 
     const activeClass =
@@ -80,9 +80,10 @@ export var ExplainingListItem = createComponent({
     const linkTo = props.disabled ? undefined : props.linkTo;
 
     const elemFn = isButton ? r.button : (props.linkTo ? LinkUnstyled : r.a);
+    const crossClass = props.disabled ? ' c_Cross' : '';
 
     let imgTitleText = rFr({},
-          r.div({ className: 'esExplDrp_entry_title' }, entry.title),
+          r.div({ className: 'esExplDrp_entry_title' + crossClass }, entry.title),
           r.div({ className: 'esExplDrp_entry_expl' }, entry.text));
     if (props.img) {
       imgTitleText = rFr({},
diff --git a/client/app-staff/admin/admin-app.staff.ts b/client/app-staff/admin/admin-app.staff.ts
index a3fff6ef2..2da5a227a 100644
--- a/client/app-staff/admin/admin-app.staff.ts
+++ b/client/app-staff/admin/admin-app.staff.ts
@@ -256,7 +256,43 @@ const AdminAppComponent = createReactClass(<any> {
   },
 
   saveSettings: function() {
-    Server.saveSiteSettings(this.state.editedSettings, (result) => {
+    const currentSettings: Settings = this.state.currentSettings;
+    const editedSettings: Settings = this.state.editedSettings;
+    const valueOf = (getter: (s: Settings) => any) =>
+      firstDefinedOf(getter(editedSettings), getter(currentSettings));
+
+    // Clone, in case the HTTP request fails.
+    const toSave = { ...this.state.editedSettings };
+
+    // Update dependant settings.
+    // Or better?: Add a changesToSave, which is what's shown and what'll be saved?
+    // Then, no need for similar logics here, and at other places. [_dep_settings]
+    //
+    // Some settings depend on other settings. The UI updates directly to reflect such
+    // dependencies, but we also need to update the data-to-save. — Shouldn't do that
+    // until now, because otherwise toggling a setting on and off, could toggle the dependant
+    // settings once, but not toggle them back. This could be unexpected, and result in
+    // admins configuring things not-as-they-want.
+    //
+    // Example: An admin toggles `enableAnonSens` on. This changes `enablePresence`
+    // to false in the UI. But if the actual data-to-save was changed too, then, if the
+    // admin later toggles `enableAnonSens` off, we wouldn't know if `enablePresence` should
+    // be toggled on again or not (without remembering its state before, ... which would
+    // mean we implemented an undo list). So, we just update the `enablePresence` UI,
+    // and won't update the actual object field unti here:
+    if (valueOf(s => s.enableAnonSens)) {
+      toSave.enablePresence = false; // [anon_sens_0_presence]
+    }
+
+    const isCatsEnabled = valueOf(s => s.showCategories);
+
+    if (!isCatsEnabled && valueOf(s => s.enableAnonSens)) {
+      // This is ok — the server will reply with an error, if trying to be anon (rather
+      // than unexpectedly using one's real name). [reject_anon_sensitive_posts]
+      toSave.enableAnonSens = false; // [anon_purp_per_cat]
+    }
+
+    Server.saveSiteSettings(toSave, (result) => {
       if (this.isGone) return;
       this.setState({
         currentSettings: result.effectiveSettings,
@@ -1467,7 +1503,7 @@ const GroupsAndPermissionLinks = function() {
   const allMembersPermsPath = '/-/groups/all_members/permissions';
   const allMembersPrefsPath = '/-/groups/all_members/preferences/notifications';
   const categoriesPath = '/categories';
-  return r.div({ className: 'c_AA_Ss_Perms' },
+  return r.div({ className: 's_A_Ss_Inf c_AA_Ss_Perms' },
 
       // (UX: Explain category permissions first — it's short & quick to read, and hopefully
       // people will then continue reading about group permissions too, further below.
@@ -1522,6 +1558,10 @@ const SpamFlagsSettings = createFactory({
 
     const LargeNumber = 9999;
 
+    // Some settings actually haven't been implemented server side. Let's hide them here (but
+    // keep the Typescript code so easy to add back later).
+    const isImpl = false;
+
     return (
       r.div({},
         !currentSettings.akismetApiKey ? null :  // currently, needs server side key
@@ -1548,6 +1588,7 @@ const SpamFlagsSettings = createFactory({
           }
         }),
 
+        !isImpl ? null :
         Setting2(props, { type: 'number', min: 0, max: LargeNumber,
           label: "Num minutes to calm down",
           help: "If someone gets his/her post hidden because of flags, s/he might get angry. " +
@@ -1596,6 +1637,7 @@ const SpamFlagsSettings = createFactory({
           }
         }),
 
+        !isImpl ? null :
         Setting2(props, { type: 'checkbox', indent: true,
           label: "Notify staff if new user blocked",
           help:
@@ -1607,6 +1649,7 @@ const SpamFlagsSettings = createFactory({
           }
         }),
 
+        !isImpl ? null :
         Setting2(props, { type: 'number', min: 0, max: LargeNumber, indent: true,
           label: "Trusted member flag weight",
           help: r.span({},
@@ -1624,6 +1667,7 @@ const SpamFlagsSettings = createFactory({
           }
         }),
 
+        !isImpl ? null :
         Setting2(props, { type: 'number', min: 0, max: LargeNumber, indent: true,
           label: "Core member flag weight",
           help: r.span({},
@@ -1655,9 +1699,13 @@ const FeatureSettings = createFactory({
       firstDefinedOf(getter(editedSettings), getter(currentSettings));
 
     const isForumEnabled = valueOf(s => s.enableForum);
+    const isCatsEnabled = valueOf(s => s.showCategories);
+    const isAnonSensEnabled = isCatsEnabled && valueOf(s => s.enableAnonSens);
     const isApiEnabled = valueOf(s => s.enableApi);
     const isApiAndCorsEnabled = isApiEnabled && valueOf(s => s.enableCors);
 
+    const anonSensDiscTitle = "Anonymous Sensitive Discussions";
+
     return (
       r.div({},
         Setting2(props, { type: 'checkbox',
@@ -1784,6 +1832,40 @@ const FeatureSettings = createFactory({
           }
         }),
 
+        !isForumEnabled ? null : Setting2(props, {
+          type: 'checkbox', label: `Enable ${anonSensDiscTitle}`, // [_anon_above]
+          className: 'e_EnbSensCB',
+          help: rFr({}, "Enables Anonymous Comments for Sensitive Discussions " +
+              "category setting. " +
+              "Hides people's online status and last-seen-at info.",
+              isCatsEnabled ? " (You also need to make the relevant categories anonymous.)" :
+                    r.i({}, " You first need to enable categories.")),
+          disabled: !isCatsEnabled,
+          getter: (s: Settings) => !isCatsEnabled ? false : s.enableAnonSens,  // [_dep_settings]
+          update: (newSettings: Settings, target) => {
+            newSettings.enableAnonSens = target.checked;
+          }
+        }),
+
+        !isForumEnabled ? null : Setting2(props, {
+          type: 'checkbox', label: "Enable See Online Presence",
+          className: 'e_EnbPresenceCB',
+          help: rFr({}, "Let's people see if others are online, and when they visited last time.",
+              !isAnonSensEnabled ? '' :
+                    rFr({}, r.br(), r.b({}, "Disabled"), " if ", r.i({}, anonSensDiscTitle),
+                    " (above) is enabled.")), // [_anon_above]
+          disabled: isAnonSensEnabled,
+          getter: (s: Settings) =>
+              // It's simpler to guess who's-who if you can see who's online when an
+              // anonymous comment appear, so the presence feature gets disabled, if
+              // Sensitive Anon Discs is enabled. [anon_sens_0_presence]
+              isAnonSensEnabled ? false : s.enablePresence,  // [_dep_settings]
+          getCurrent: (s:Settings) => s.enablePresence,
+          update: (newSettings: Settings, target) => {
+            newSettings.enablePresence = target.checked;
+          }
+        }),
+
         !isForumEnabled ? null : Setting2(props, {
           type: 'checkbox',
           label: "Enable similar topics",
@@ -2953,12 +3035,14 @@ const CustomizePanel = createFactory({
       r.div({ className: 'esA_Ss s_A_Ss-LaF' },
         r.ul({ className: 'esAdmin_settings_nav col-sm-2 nav nav-pills nav-stacked' },
           LiNavLink({ to: bp + 'basic', id: 'e_A_Ss-LaF_Basic' }, "Basic"),
-          LiNavLink({ to: bp + 'html', id: 'e_A_Ss-LaF_Html' }, "HTML"),
+          LiNavLink({ to: bp + 'login', id: 'e_A_Ss-LaF_AuD' }, "Login Dialog"),
+          LiNavLink({ to: bp + 'html', id: 'e_A_Ss-LaF_Html' }, "Custom HTML"),
           LiNavLink({ to: bp + 'css-js', id: 'e_A_Ss-LaF_CssJs' }, "CSS and JS")),
         r.div({ className: 'form-horizontal esAdmin_settings col-sm-10' },
           Switch({},
             // [React_Router_v51] skip render(), use hooks and useParams instead.
             Route({ path: bp + 'basic', render: () => CustomizeBasicPanel(childProps) }),
+            Route({ path: bp + 'login', render: () => CustomizeLoginPanel(childProps) }),
             Route({ path: bp + 'html', render: () => CustomizeHtmlPanel(childProps) }),
             Route({ path: bp + 'css-js', render: () => CustomizeCssJsPanel(childProps) })),
             )));
@@ -3250,6 +3334,134 @@ const CustomizeBasicPanel = createFactory({
 });
 
 
+const CustomizeLoginPanel = React.createFactory<any>(function(props) {
+
+  const currentSettings: Settings = props.currentSettings;
+  const editedSettings: Settings = props.editedSettings;
+
+  const valueOf = (getter: (s: Settings) => any) =>
+    firstDefinedOf(getter(editedSettings), getter(currentSettings));
+
+  const userMustBeAuthenticated = valueOf(s => s.userMustBeAuthenticated);
+
+  const useOpenAuth = login.isSocialLoginEnabled(currentSettings);
+
+  const useOnlyCustomIdps = valueOf(s => s.useOnlyCustomIdps);
+  const store: Store = props.store;
+  const customIdps: IdentityProviderPubFields[] = store.settings.customIdps || [];
+  const onlyOneCustomIdp = customIdps.length === 1;
+
+  const enableTySso = valueOf(s => s.enableSso);
+  const enableTySsoOrOnlyCustIdps = enableTySso || useOnlyCustomIdps;
+
+  // If the site is public, no login page is shown to strangers. And, if clicking Log In
+  // redirects to an external login page, Ty's login dialog is never shown.
+  const dialogNeverShown = !userMustBeAuthenticated && (
+            enableTySso || useOnlyCustomIdps && onlyOneCustomIdp);
+
+  function mkLoginSetting(label: St, className: St, fieldName: (keyof AuthnDiagConfV0),
+          help?: St, type?: 'textarea') {
+    return Setting2(props, {
+        type,
+        label,
+        className,
+        help,
+        getter: (s: Settings) => {
+          const anyConf: AuthnDiagConfV0 | U = s.authnDiagConf?.c0[0];
+          return anyConf && anyConf[fieldName];
+        },
+        update: (newSettings: Settings, target) => {
+          const anyCurConf: AuthnDiagConf | U = valueOf(s => s.authnDiagConf);
+          const curConf: AuthnDiagConfV0 = anyCurConf?.c0[0] || {};
+          const newConf = { ...curConf };
+          newConf[fieldName] = target.value;
+          newSettings.authnDiagConf = { c0: [newConf] };
+        }
+      });
+  }
+
+  const andClickLogin = userMustBeAuthenticated ? '' :
+          rFr({}, ", and click ", r.b({}, "Log In"));
+
+  return (
+    r.div({ className: 'form-horizontal esAdmin_customize' },
+
+      !dialogNeverShown ? null :
+        r.div({ className: 's_A_Ss_Inf' },
+          Alert({ bsStyle: 'info' },
+            r.p({}, r.b({}, "Not in use."), " You've configured external login."),
+            //r.p({}, "And, login not required, so the login dialog isn't shown.")
+            )),
+
+      r.div({ className: 's_A_Ss_Inf' + (dialogNeverShown ? ' c_Cross' : '') },
+        r.h2({ className: 's_A_Ss_S_Ttl'},
+          "Login Dialog"),
+        r.p({},
+          "Here you can add a title and intro text to the login dialog. " +
+          "It'll be publicly visible."),
+        r.p({},
+          "To view the dialog without logging out yourself, open an incognito browser window, " +
+          "e.g. click Ctrl+Shift+N if you use Chrome, and go to ", r.samp({}, location.origin),
+          andClickLogin,
+          ". (After you've saved any changes.)"),
+        r.p({},
+          "(All changes are ignored if you login at /-/admin/ — in case you manage to " +
+          "break the login dialog.)"),
+        ),
+
+      mkLoginSetting("Login dialog title", 'e_CuAuD_Ttl', 'headerText'),
+
+      mkLoginSetting("Login intro text", 'e_CuAuD_Intro', 'introHtml',
+            "Here you can explain who this forum is for, and how it's " +
+            "helpful to them. You can use HTML.", 'textarea'),
+
+      mkLoginSetting("Login dialog image", 'e_CuAuD_Img', 'imageUrl',
+            "An image URL, e.g. your company or university building " +
+            "or logo, or office cat."),
+
+      !enableTySsoOrOnlyCustIdps ? null :
+        r.div({ className: 's_A_Ss_Inf' },
+          r.p({},
+            "Ignore the stuff below. It's not in use, since you're using external login, " +
+            // If login was required, strangers would see the login dialog, and a button
+            // that would redirect them to the SSO server.  But when login not required, they
+            // instead see the forum directly (public categroies). And clicking Log In should
+            // redirect them immediately.
+            "and login not required to read.")),
+
+      r.div({ className: enableTySsoOrOnlyCustIdps ? 'c_Cross' : '' },
+        r.div({ className: 's_A_Ss_Inf' },
+          r.h3({ className: 's_A_Ss_S_Ttl'},
+            "Labels"),
+          r.p({}, "Here you can change built-in login and signup dialog labels. To remove " +
+              "a label, set it to a hyphen/minus, '", r.code({}, '-'), // [dash_hides_label]
+              "'."),
+          r.p({}, r.b({}, "Usually it's better to leave this as-is.")),
+          r.p({}, "The labels to the left, is the deault text (in English). For example, \"",
+            r.i({}, t.ld.ContinueWithDots), "\" is one of the default texts.")),
+
+        r.div({ className: !useOpenAuth ? 'c_Cross' : '' },
+          r.div({ className: 's_A_Ss_Inf' },
+            r.h4({}, "External login enabled"),
+            r.p({}, "If Gmail, Facebook etc login is enabled, you can edit these labels. " +
+              "Or if your own custom OpenAuth or OIDC login is enabled.")),
+
+          mkLoginSetting(t.ld.ContinueWithDots, '', 'continueWithCta'),
+          // UX COULD hide these two, if local accounts aren't enabled.
+          mkLoginSetting(t.ld.OrCreateAcctHere, '', 'orCreateAcctCta'),
+          mkLoginSetting(t.ld.OrLogIn, '', 'orLogInCta')),
+
+        r.div({ className: useOpenAuth ? 'c_Cross' : '' },
+          r.div({ className: 's_A_Ss_Inf' },
+            r.h4({}, "Only local accounts"),
+            r.p({}, "If Gmail, Facebook etc login isn't enabled, and you don't use " +
+                "any custom OpenAuth, you can edit these labels.")),
+
+          mkLoginSetting(t.ld.SignUp, '', 'signUpCta'),
+          mkLoginSetting(t.ld.LogIn, '', 'logInCta')),
+      )));
+});
+
 
 const CustomizeHtmlPanel = createFactory({
   displayName: 'CustomizeHtmlPanel',
@@ -3257,7 +3469,7 @@ const CustomizeHtmlPanel = createFactory({
   render: function() {
     const props = this.props;
     const currentSettings: Settings = props.currentSettings;
-    let navConfJsonExeption;
+    let navConfJsonExeption: St | NU;
 
     return (
       r.div({ className: 'form-horizontal esAdmin_customize' },
@@ -3400,8 +3612,8 @@ function Setting2(panelProps, props, anyChildren?) {
   const defaultSettings = panelProps.defaultSettings;
 
   let editedValue = props.getter(editedSettings);
-  let currentValue = props.getter(currentSettings);
-  const defaultValue = props.getter(defaultSettings);
+  let currentValue = (props.getCurrent || props.getter)(currentSettings);
+  const defaultValue = (props.getCurrent || props.getter)(defaultSettings);
 
   let disabled = props.disabled;
 
@@ -3414,6 +3626,8 @@ function Setting2(panelProps, props, anyChildren?) {
     disabled = true;
   }
 
+  const editedAndDifferent = isDef(editedValue) && editedValue !== currentValue;
+
   const effectiveValue = firstDefinedOf(editedValue, currentValue);
 
   dieIf(props.onChange, 'EsE3GUK02');
@@ -3432,7 +3646,7 @@ function Setting2(panelProps, props, anyChildren?) {
   if (props.type === 'textarea') props.className += ' s_A_Ss_S-Textarea';
   props.wrapperClassName = 'col-sm-9 esAdmin_settings_setting';
 
-  if (isDefined2(editedValue)) props.wrapperClassName += ' esAdmin_settings_setting-unsaved';
+  if (editedAndDifferent) props.wrapperClassName += ' esAdmin_settings_setting-unsaved';
   if (disabled) props.wrapperClassName += ' disabled';
 
   if (props.type === 'checkbox') {
@@ -3458,8 +3672,8 @@ function Setting2(panelProps, props, anyChildren?) {
   const field = props.type === 'checkbox' ? 'checked' : 'value';
   const event = { target: {} };
 
-  let undoChangesButton;
-  if (isDefined2(editedValue)) {
+  let undoChangesButton: RElm | U;
+  if (editedAndDifferent && !disabled) {
     undoChangesButton = Button({ className: 'col-sm-offset-3 esAdmin_settings_setting_btn',
       disabled, onClick: props.undo || (() => {
         event.target[field] = currentValue;
@@ -3468,8 +3682,8 @@ function Setting2(panelProps, props, anyChildren?) {
   }
 
   // Show the Reset button only if there's no Undo button — both at the same time looks confusing.
-  let resetToDefaultButton;
-  if (!undoChangesButton && effectiveValue !== defaultValue && props.canReset !== false) {
+  let resetToDefaultButton: RElm | U;
+  if (!undoChangesButton && effectiveValue !== defaultValue && props.canReset !== false && !disabled) {
     resetToDefaultButton = Button({ className: 'col-sm-offset-3 esAdmin_settings_setting_btn',
       disabled, onClick: props.reset || (() => {
         event.target[field] = defaultValue;
diff --git a/client/app-staff/admin/admin-page.styl b/client/app-staff/admin/admin-page.styl
index 8898a5013..18025482d 100644
--- a/client/app-staff/admin/admin-page.styl
+++ b/client/app-staff/admin/admin-page.styl
@@ -23,6 +23,14 @@
 .esA_Ss
   clearfix();
 
+// Info block: Title and text that explain some settings below.
+.s_A_Ss_Inf
+  margin: 0 0 27px 23px;
+  padding-right: 15px;
+
+  .s_A_Ss_S_Ttl
+    padding-top: 0;  // try to remove outside _Inf too?
+
 .s_A_Ss_S_Ttl
   margin-top: 25px;
   margin-bottom: 20px;
@@ -37,8 +45,9 @@
 .s_A_Ss_S .checkbox
   margin-bottom: 8px;
 
-.s_A_Ss_S input[type="text"]
-  width: 370px;   // or too small
+.s_A_Ss_S input[type="text"],
+.s_A_Ss_S input:not([type])  // the default is 'text', if type absent
+  width: 375px;   // or too small
   max-width: 95%; // or too wide, on narrow phones
 
 .s_A_Ss_AlwCrsFrm .input-group textarea
@@ -106,6 +115,10 @@
   .control-label
     padding-top: 17px; // 7 -> 17 because of padding-top below [930KPU12]
 
+.esAdmin_settings
+  .c_Cross
+    opacity: 0.6
+
 .esAdmin_settings_nav
   background: #eee;
   padding-right: 0;
diff --git a/client/app-staff/admin/users.staff.ts b/client/app-staff/admin/users.staff.ts
index 132f1e516..6c495dbdb 100644
--- a/client/app-staff/admin/users.staff.ts
+++ b/client/app-staff/admin/users.staff.ts
@@ -283,6 +283,7 @@ const UserList = createFactory<any>({
               r.th({}, "Email"),
               actionHeader,
               r.th({}, "Last seen"),
+              r.th({}, "Last posted"),
               r.th({}, "Topics viewed"),
               r.th({}, "Time spent reading"),
               r.th({}, "Num posts"),
@@ -327,17 +328,17 @@ const UserRow = createFactory<any>({
     const user: UserInclDetailsWithStats = this.props.user;
     const nowMs: WhenMs = this.props.now;
 
-    let actions;
+    let actions: RElm | U;
     if (this.props.whichUsers !== 'WaitingUsers') {
       // Don't show any actions.
     }
     else if (this.state.wasJustApproved || this.state.wasJustRejected) {
-      actions = rFragment({},
+      actions = rFr({},
         this.state.wasJustApproved ? "Approved. " : "Rejected. ",
         Button({ onClick: this.undoApproveOrReject, className: 'e_UndoApprRjctB' }, "Undo"));
     }
     else {
-      actions = rFragment({},
+      actions = rFr({},
           Button({ onClick: this.approveUser, className: 'e_ApproveUserB' }, "Approve"),
           Button({ onClick: this.rejectUser, className: 'e_RejectUserB'  }, "Reject"));
     }
@@ -347,7 +348,7 @@ const UserRow = createFactory<any>({
         : null;
 
     const usernameElem = r.span({ className: 'dw-username' }, user.username);
-    let fullNameElem;
+    let fullNameElem: RElm | U;
     if (user.fullName) {
       fullNameElem = r.span({ className: 'dw-fullname' }, ' (' + user.fullName + ')');
     }
@@ -356,7 +357,7 @@ const UserRow = createFactory<any>({
     const isDeactivated = !!user.deactivatedAt;
     const isDeleted = !!user.deletedAt;
 
-    const modifiers = rFragment({},
+    const modifiers = rFr({},
         user.isApproved !== false ? null :
             r.span({ className: 's_A_Us_UsL_U_Modif' }, " — rejected"),
         !isStaff(user) ? null :
@@ -374,22 +375,31 @@ const UserRow = createFactory<any>({
     const emailNotVerified = !user.email || user.emailVerifiedAtMs ? null :
       r.span({ className: 's_A_Us_UsL_U_Modif e_EmNotVerfd' }, " — not verified");
 
-    let lastSeen;
-    let topicsViewed;
-    let timeSpentReading;
-    let numPosts;
+    let lastSeen: St | NU;
+    let lastPostedAt: St | NU;
+    let topicsViewed: Nr | U;
+    let timeSpentReading: St | NU;
+    let numPosts: Nr | U;
 
     if (user.anyUserStats) {
+      // If presence disabled (!Settings.enablePresence), most info here is excluded.
+      // Sometimes it'd be good, though, if [admins_see_presence].  And sometimes we'd want to
+      // hide presence info up to when presence got (re)enabled. [see_presence_start_date]
       const s = user.anyUserStats;
-      lastSeen = debiki.prettyLetterDuration(s.lastSeenAt, nowMs);
-      topicsViewed = s.numChatTopicsEntered + s.numDiscourseTopicsEntered;
-      timeSpentReading = debiki.prettyLetterDuration(s.numSecondsReading * 1000);
-      numPosts =
+      lastSeen = !s.lastSeenAt ? null : debiki.prettyLetterDuration(s.lastSeenAt, nowMs);
+      lastPostedAt = !s.lastPostedAt ? null : debiki.prettyLetterDuration(s.lastPostedAt, nowMs);
+      // (Should be enough to check just one, when adding. Either none or all should be set.)
+      topicsViewed = !isVal(s.numChatTopicsEntered) ? null :
+                            s.numChatTopicsEntered + s.numDiscourseTopicsEntered;
+      timeSpentReading = !isVal(s.numSecondsReading) ? null :
+                            debiki.prettyLetterDuration(s.numSecondsReading * 1000);
+      numPosts = !isVal(s.numChatMessagesPosted) ? null :
           s.numChatMessagesPosted + s.numChatTopicsCreated +
           s.numDiscourseRepliesPosted + s.numDiscourseTopicsCreated;
     }
 
-    const createdAt = debiki.prettyLetterDuration(user.createdAtEpoch, nowMs);
+    const createdAt = !user.createdAtEpoch ? null :
+                            debiki.prettyLetterDuration(user.createdAtEpoch, nowMs);
 
     return (
       r.tr({},
@@ -397,6 +407,7 @@ const UserRow = createFactory<any>({
         r.td({}, user.email, emailNotVerified),
         actionsCell,
         r.td({}, lastSeen),
+        r.td({}, lastPostedAt),
         r.td({}, topicsViewed),
         r.td({}, timeSpentReading),
         r.td({}, numPosts),
diff --git a/client/types-and-const-enums.ts b/client/types-and-const-enums.ts
index a0ef058c0..b9d9c976b 100644
--- a/client/types-and-const-enums.ts
+++ b/client/types-and-const-enums.ts
@@ -121,6 +121,7 @@ type RefOrId = Ref | number;
 
 
 const enum UrlPaths {
+  AdminArea = '/-/admin/',
   AdminLogin = '/-/admin-login',
   AuthnRoot = '/-/authn/',
   Groups = '/-/groups/',
diff --git a/conf/routes b/conf/routes
index 2ab04bd22..d43d77442 100644
--- a/conf/routes
+++ b/conf/routes
@@ -21,8 +21,8 @@
 
 GET   /-/login                  controllers.LoginController.showLoginPage(as: Option[String], to: Option[String])
 GET   /-/login-popup            controllers.LoginController.showLoginPopup(mode: Int, returnToUrl)
-GET   /-/logout                 controllers.LoginController.logout(currentUrlPath: Option[String])
-POST  /-/logout                 controllers.LoginController.logout(currentUrlPath: Option[String])
+GET   /-/logout                 controllers.LoginController.logout_get_post(currentUrlPath: Option[String])
+POST  /-/logout                 controllers.LoginController.logout_get_post(currentUrlPath: Option[String])
 POST  /-/resend-owner-email-addr-verif-email controllers.LoginController.resendSiteOwnerAddrVerifEmail
 
 # REFACTOR Would like to remove, use  /-/authn/password/
@@ -54,7 +54,7 @@ POST  /-/impersonate            controllers.ImpersonateController.impersonate(us
 POST  /-/view-as-other          controllers.ImpersonateController.viewAsOther(userId: Int)
 POST  /-/stop-impersonating     controllers.ImpersonateController.stopImpersonating
 
-GET   /-/load-online-users      talkyard.server.pubsub.SubscriberController.loadOnlineUsers
+#GET   /-/load-online-users      talkyard.server.pubsub.SubscriberController.loadOnlineUsers
 GET   /-/websocket              talkyard.server.pubsub.SubscriberController.webSocket
 
 GET   /-/embedded-comments      controllers.EmbeddedTopicsController.showTopic(embeddingUrl, discussionId: Option[String], edPageId: Option[String], category: Option[String], scriptV: Option[String])
diff --git a/relchans/tyse-v0-dev b/relchans/tyse-v0-dev
index 7ffd6aa86..c07307783 160000
--- a/relchans/tyse-v0-dev
+++ b/relchans/tyse-v0-dev
@@ -1 +1 @@
-Subproject commit 7ffd6aa86153045ab663ed1450f8c4dc4940c1c6
+Subproject commit c073077831709cef2ecb6f49851805835ea78bfd
diff --git a/tests/e2e-wdio7/test-types2.ts b/tests/e2e-wdio7/test-types2.ts
index 8cca9f6ab..457c9344b 100644
--- a/tests/e2e-wdio7/test-types2.ts
+++ b/tests/e2e-wdio7/test-types2.ts
@@ -240,8 +240,12 @@ interface TestSiteSettings {
   numFlagsToBlockNewUser?: number;
   numFlaggersToBlockNewUser?: number;
   enableForum?: Bo;
+  enableApi?: Bo;
   enableTags?: Bo;
-  enableApi?: boolean;
+  enableChat: Bo;
+  enableDirectMessages: Bo;
+  enableAnonSens: Bo
+  enablePresence: Bo
   ssoUrl?: string;
   enableSso?: boolean;
 
diff --git a/version.txt b/version.txt
index 3a75eb0bc..9f0f0d124 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-v0.2024.007
+v0.2024.008
diff --git a/wip/aliases/wip.txt b/wip/aliases/wip.txt
index 6ff101148..70d525532 100644
--- a/wip/aliases/wip.txt
+++ b/wip/aliases/wip.txt
@@ -73,6 +73,10 @@ Minor & medium:
     Basically any changes on the user and group profile pages.
 
 Even later:
+  - Let [admins_see_presence] if needed, although disabled if sensitive anon comts enabled.
+  - If disabling and later enabling the Presence feature, then, remember when it was enabled,
+    and continue hiding presence up until then.  E.g. show  Last-seen-at  only if
+    it's after the point in time when Presence got reenabled. [see_presence_start_date]
   - A [see_alias] permission, so can choose to see who an anonym is,
        or can vote to see who an anon is.
   - Ask the server which alias to use, instead of deriving client side [fetch_alias]