Authentication simply hides the admin links in the navbar, instead of denying access to them
In the default generated app, as a non-admin user, I don't see the links "Users" and "Teams" in the navigation bar.
If however, I type /users
or /teams
in the browser's url bar, I get to see the page, just like the admin would.
Also happens on its own (without me typing anything in the url bar) if I'm logged in as admin, go to the teams page, logout, and then login as a normal user (as the url now has the next
query param).