If you call an url without passing an access token, you get this exception :
League \ OAuth2 \ Server \ Exception \ InvalidRequestException
The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the "access token" parameter.
I think it will be better to have a 403 instead.