It seems these 2 points from the release notes are not quite working as intended:

• security fix: if the title or url fields exactly matched the hostname, without the scheme prefix (ie http, https), it would send the credentials without prompting. this has been changed now to always prompt, if it hasn't already been allowed.

• data is now stored in Custom Data, it will prompt you to move your existing settings when opening a db with data in the legacy location.

After the update the plugin said it migrated my data and told me to delete the entry KeePassHttp Settings from my Database.
After I did that some entries still have KeePassHttp Settings as advanced String fields. I'm not sure but I think on some fields it was removed. However, every page prompts for the credentials and asks me to allow it. After saving it that time everything seems to be working for that entry.

But now for each entry it asks again to allow or disallow the autofill which is kind of annoying.