Hi @cosmosis,
Whether players need to create an account on The Forge or not depends on whether your game is set to Private or Public, you can read more about the two modes here : Public & Private Games
If your daughter and/or players are under 13 years old, they shouldn’t be creating accounts (due to child privacy protection laws), so you should set the game to public in that case, otherwise it’s highly recommend that they create accounts of their own.
As for the second question, no, a player account shouldn’t access the Foundry setup page. If you haven’t launched a world yet, they should be shown an error saying they can’t access it because the game is currently being configured, unless you have set an admin access key, in which case the Foundry setup page becomes available to everyone (as long as they can enter the correct access key).
One possibility (trying to think of why it would happen) is if you have set an admin access key, then you authenticated to Foundry, then within the same browser, you logged out of the forge (but not of foundry itself) so when you created your test account and went back to the setup page, Foundry still got access to the cookies it had set and gave the test account access to the setup screen.
Does that make sense?