Authorization Token allows action without login

[ildyria]

Discussed in https://github.com/LycheeOrg/Lychee/discussions/2301

^{Originally posted by agademer February 26, 2024}

2/ A user with may_upload=0 can still upload a photo through Photo::add (with the help of the famous API TOKEN).

• Is 2/ a bug that will be solve in the future ? or a normal behavior ?