(follow-up from bug 36085) We now restrict access to the protected flag in the GUI. This should also be replicated out to the REST API.