A normal user (not admin) can view and change (!) the payload codec from device-profile configuration. Is it really supposed to be so? Can it be made visible only to organisation admins? I mean, when there was the possibility to set up the payload codec per application in earlier versions, normal users did not have any access to codec. I think it should be so even with per device-profile settings.
OK, after some trying I see now, that normal users can’t change codec settings (they can “change” them using GUI but ‘Update device-profile’ button is not active for them). In any way, they can still see possible settings and custom JS decoder/encoder and as I wrote in the previous message, it was not the case in early versions, where the payload codec was set per application.
It is better to report issues or bugs on GitHub, for LoRa App Server: https://github.com/brocaar/lora-app-server.