Merge pull request #6774 from pixelfed/fix/oauth-scope-bypass-remove-follower-6643

Fix: OAuth accountRemoveFollowById to check token.

app/Http/Controllers/Api/ApiV1Controller.php

@@ -4751,7 +4751,7 @@ class ApiV1Controller extends Controller
 
     public function accountRemoveFollowById(Request $request, $id)
     {
-        abort_if(! $request->user(), 403);
+        abort_if(! $request->user() || ! $request->user()->token(), 403);
         abort_unless($request->user()->tokenCan('follow'), 403);
 
         $pid = $request->user()->profile_id;