Just discovered that you can browse right into the /zen directory and thus access any of the admin files. I stuck an "index.html" file in that directory with this meta line in it:
Of course.. You can add some lines to .htacces, i think that it has to do something with open indexes. Or you can place blank index.htm (whatever) to disable this dir.
Maybe we should add that to the release... just for safety's sake. Shouldn't be too big a problem though. Kind of useful to just go to /zen/ for the admin, actually.