What prevents the authorization in this Laravel 8 API?