Setup page is publicly available after instance created

[Nutomic]

It can only be used to create normal user accounts, but the route should still be disabled.

https://lemmy.ml/setup

https://ds9.lemmy.ml/setup

via https://lemmy.ml/post/717182/comment/373149

[heylix]

Same for /settings.

Even though the site is available, you can't really create a new admin, it just shows a spinner indefinitely.

"Fixed" with nginx rule:

    location /setup {
        deny all;
        return 403;
    }

Ideally /setup would just return 403 or 404 when there's a user with an admin ID already.