Fix middleware order for personal access token.

Fixes for artisan commands.

app/Http/Controllers/Extension/Sandbox/InternalController.php

@@ -20,7 +20,9 @@ class InternalController extends Controller
 {
     public function __construct()
     {
-        $this->checkPermissions();
+        if (array_key_exists("SERVER_ADDR", $_SERVER)) {
+            $this->checkPermissions();
+        }
     }
 
     /**

app/Http/Kernel.php

@@ -20,14 +20,13 @@ class Kernel extends HttpKernel
             Middleware\EncryptCookies::class,
             \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
             \Illuminate\Session\Middleware\StartSession::class,
+            \App\Http\Middleware\APILogin::class,
             \Illuminate\Session\Middleware\AuthenticateSession::class,
             Middleware\Language::class,
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
-            //Middleware\VerifyCsrfToken::class,
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
             \App\Http\Middleware\ForcePasswordChange::class,
             \App\Http\Middleware\RestrictedMode::class,
-            \App\Http\Middleware\APILogin::class,
         ],
     ];