How to prevent a Laravel security leak where an API returns not found when you are not authenticated

// Path: app/Http/Controllers/Api/V1/UserController.php
<?php

namespace AppHttpControllersApiV1;

use AppHttpControllersController;
use AppUser;
use IlluminateHttpRequest;

class UserController extends Controller
{
    public function show(User $user)
    {
        return $user;
    }
}

// Path: app/User.php
<?php

namespace App;

use IlluminateNotificationsNotifiable;
use IlluminateFoundationAuthUser as Authenticatable;

class User extends Authenticatable
{
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name', 'email', 'password',
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password', 'remember_token',
    ];
}

// Path: routes/api.php
<?php

Route::get('/v1/user/{user}', 'ApiV1UserController@show')->middleware('can:show,user');

// Path: app/Providers/AuthServiceProvider.php
<?php

namespace AppProviders;

use IlluminateFoundationSupportProvidersAuthServiceProvider as ServiceProvider;
use IlluminateSupportFacadesGate;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        'AppModel' => 'AppPoliciesModelPolicy',
    ];

    /**
     * Register any authentication / authorization services.
     *
     * @return void
     */
    public function boot()
    {
        $this->registerPolicies();

        //
    }
}

// Path: app/Http/Middleware/Can.php
<?php

namespace AppHttpMiddleware;

use Closure;
use IlluminateAuthAccessAuthorizationException;
use IlluminateAuthAccessResponse;
use IlluminateSupportFacadesGate;

class Can
{
    /**
     * Handle an incoming request.
     *
     * @param  IlluminateHttpRequest  $request
     * @param  Closure  $next
     * @param  string  $ability
     * @param  array|string  $arguments
     * @return mixed
     *
     * @throws IlluminateAuthAccessAuthorizationException
     */
    public function handle($request, Closure $next, $ability, ...$arguments)
    {
        if (Gate::denies($ability, $arguments)) {
            throw new AuthorizationException(
                'This action is unauthorized.', null, Response::deny()
            );
        }

        return $next($request);
    }
}

// Path: app/Http/Kernel.php
<?php

namespace AppHttp;

use AppHttpMiddlewareCan;
use IlluminateFoundationHttpKernel as HttpKernel;

class Kernel extends HttpKernel
{
    /**
     * The application's global HTTP middleware stack.
     *
     * These middleware are run during every request to your application.
     *
     * @var array
     */
    protected $middleware = [
        IlluminateFoundationHttpMiddlewareCheckForMaintenanceMode::class,
    ];

    /**
     * The application's route middleware groups.
     *
     * @var array
     */
    protected $middlewareGroups = [
        'web' => [
            AppHttpMiddlewareEncryptCookies::class,
            IlluminateCookieMiddlewareAddQueuedCookiesToResponse::class,
            IlluminateSessionMiddlewareStartSession::class,
            // IlluminateSessionMiddlewareAuthenticateSession::class,
            IlluminateViewMiddlewareShareErrorsFromSession::class,
            AppHttpMiddlewareVerifyCsrfToken::class,
            IlluminateRoutingMiddlewareSubstituteBindings::class,
        ],

        'api' => [
            'throttle:60,1',
            'bindings',
        ],
    ];

    /**
     * The application's route middleware.
     *
     * These middleware may be assigned to groups or used individually.
     *
     * @var array
     */
    protected $routeMiddleware = [
        'auth' => IlluminateAuthMiddlewareAuthenticate::class,
        'auth.basic' => IlluminateAuthMiddlewareAuthenticateWithBasicAuth::class,
        'bindings' => IlluminateRoutingMiddlewareSubstituteBindings::class,
        'cache.headers' => IlluminateHttpMiddlewareSetCacheHeaders::class,
        'can' => Can::class,
        'guest' => AppHttpMiddlewareRedirectIfAuthenticated::class,
        'signed' => IlluminateRoutingMiddlewareValidateSignature::class,
        'throttle' => IlluminateRoutingMiddlewareThrottleRequests::class,
        'verified' => IlluminateAuthMiddlewareEnsureEmailIsVerified::class,
    ];
}

// Path: app/Http/Controllers/Api/V1/UserControllerTest.php
<?php

namespace TestsFeatureApiV1;

use AppUser;
use IlluminateFoundationTestingRefreshDatabase;
use IlluminateFoundationTestingWithFaker;
use TestsTestCase;

class UserControllerTest extends TestCase
{
    use RefreshDatabase;

    public function testShow()
    {
        $user = factory(User::class)->create();

        $response = $this->getJson("/api/v1/user/{$user->id}");

        $response->assertStatus(200);
    }

    public function testShowUnauthorized()
    {
        $user = factory(User::class)->create();

        $response = $this->getJson("/api/v1/user/{$user->id}");

        $response->assertStatus(403);
    }

    public function testShowUnauthorizedWithPolicy()
    {
        $user = factory(User::class)->create();

        $response = $this->getJson("/api/v1/user/{$user->id}");

        $response->assertStatus(403);
    }
}

// Path: app/Policies/UserPolicy.php
<?php

namespace AppPolicies;

use AppUser;
use IlluminateAuthAccessHandlesAuthorization;

class UserPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view the model.
     *
     * @param  AppUser  $user
     * @param  AppUser  $model
     * @return mixed
     */
    public function show(User $user, User $model)
    {
        return $user->id === $model->id;
    }
}