reMember 1.4.0

• Enhancement: Clothing sizes keep the member's actual size and show the inventory size that is available. Settings → Clothing has a write-in Stock table per category; Available as is filled from that, not the seeded body-size list. Dropdowns and staff views use labels like XL (available L). Database 1.41.0.
• Fix: Hide the Bluehost plugin's "Login with Bluehost" button on wp-login.php so members use username and password. Filter remember_hide_hosting_sso to keep the button.
• Enhancement: Nonced front-end Log out via Appearance → Menus (reMember box), a Log out block in the Site Editor Navigation, a Custom Link to /remember-logout, or [remember_logout]. The admin bar is hidden when the only WordPress role is Subscriber.
• Enhancement: Members can change their password on Edit Profile (current, new, confirm under Basic Information) with Save Profile.
• Enhancement: Interests is limited to 2,000 characters (plain text) on registration, profile edit, and admin member edit, with a live counter.
• Security: Event apply builds add-on names/descriptions and role labels as text, not HTML.
• Security: CSV exports prefix cells that start with =, +, -, or @ so Excel/LibreOffice will not treat member-controlled text as a formula.
• Security: Browser security headers on front, login, admin, and REST. Filter remember_security_headers to tighten or disable.
• Security: Unauthenticated GET /wp-json/wp/v2/users no longer returns login slugs.
• Security: XML-RPC stays available for Jetpack and the WordPress mobile app; pingback methods and open pings are removed.
• Security: Debug logs no longer write to the public /wp-content/debug.log URL.

Update: this release should appear under Plugins → Updates if you are on 1.3.7 or later. Otherwise download remember-1.4.0.zip below (not GitHub's "Source code" zip, which unpacks to the wrong folder name). Load any admin page once after updating so database migrations through 1.41.0 run.