- /security/cloud-tokens returns 403 for members instead of crashing on a null token list - /settings/oauth redirects non-admins to the dashboard; it used the missing route "home" and a wrong redirect return type