Pi User and Management User(s)
Note: This note was originally in the Raspberry Pi 2/3: Chromium in Kiosk mode post.
Auto-login to the GUI works regardless of the
pi user's password.
It is worth changing this for security, potentially creating a management user which requires a password to sudo and ensuring SSH access is only allowed via public key.