Standard User is able to Create Oauth Clients and Access Tokens

[krebbi]

A Standard User is able to open /settings/developer and create OAuth clients as well as Personal Access Tokens.
He can also visit all /other settings pages, but don't get any further information.

The Routes to /settings (admin area) do need some protection.

[John94php]

maybe via Gate or middleware

[John94php]

e.g

        if (!Gate::allows('isAdmin')) {
            return $this->unauthorizedResponse();
        }