title: Laravel 5.3 and API authentication using api_token
body: <p>I have followed the steps of this <a href="https://gistlog.co/JacobBennett/090369fbab0b31130b51" rel="nofollow noreferrer">tutorial</a> in order to setup API authentication in Laravel 5.3 using the <code>auth:api</code> middleware.</p>
  
  <p>Everything is working as expected apart from I am finding that in order to successfully access my API, I only need to provide an API token for <em>any</em> user in my <code>users</code> table rather than the token linked to the user currently logged in.</p>
  
  <p>Is this expected behaviour because this middleware is stateless? I am using <a href="https://github.com/Adldap2/Adldap2-Laravel" rel="nofollow noreferrer">AdLdap2</a> to authenticate users but I can't see what I could be doing wrong especially as I have followed the steps in the tutorial above.</p>
  
  <p>I have also had a look at <a href="https://laravel.com/api/5.3/Illuminate/Auth/TokenGuard.html" rel="nofollow noreferrer">TokenGuard</a> which deals with API token validation but can't see any logic that ensures the token matches that of the user logged in.</p>
  
  <p>Any help is much appreciated.</p>