Based on @krsyoung’s code, I achieved the same thing with a q-btn:

<q-btn
  glossy
  v-if="$auth.isAuthenticated()"
  label="Profile menu"
>
  <img class="profile" width="30" height="30" :src="$auth.user.picture" />

  <q-popover
    anchor="bottom right"
    self="top right">
    <q-list link>
      <q-list-header>{{ $auth.user.name }}</q-list-header>
      <q-item @click.native="logOut">
        <q-item-side icon="lock_open" />
        <q-item-main>
          <q-item-tile
            label>
            Log Out
          </q-item-tile>
        </q-item-main>
      </q-item>
    </q-list>
  </q-popover>
</q-btn>