This might be considered a bug, but probably nobody thought that anyone would try what I tried.
With udp and global discovery disabled, I feel fairly self-contained on local network.
Got fed up with insecure web access message, I set a password without a user on headless raspberry pi.
Web gui didn’t ask for a password and displayed without folders or devices.
Also syncthing-inotify couldn’t connect to rest interface.
As I had basic gui, deleted password from settings and aok.
It may not make sense to you to have a password without a userid (it does to me) - in which case some validation is necessary in settings that both or neither are present. Hopefully, this should fix problem with inotify/rest.
Comments?