No password is set.
Nobody can sign in until these two are set on the host. That is on purpose — without them this app would show every contact to anyone with the link.
APP_PASSWORD = the password Jade will type SESSION_SECRET = a long random string