FIX: fix some security issue

app/Http/Middleware/Authenticate.php

@@ -17,12 +17,12 @@ class Authenticate
      */
     public function handle($request, Closure $next, $guard = null)
     {
-        if (Auth::check()) {
+        if (!Auth::check($guard)) {
             if ($request->ajax()) {
                 return response('Unauthorized.', 401);
-            } else {
-                return redirect()->guest('login');
             }
+
+            return redirect()->guest('login');
         }
 
         return $next($request);

app/Http/Requests/CreateNewUser.php

@@ -14,7 +14,8 @@ class CreateNewUser extends Request
      */
     public function authorize()
     {
-        return \Auth::$user->role == User::ROLE_ADMIN;
+
+        return \Auth::check() && \Auth::$user->role == User::ROLE_ADMIN;
     }
 
     /**