Actually check if the meta is protected, not just disable all post_meta ...

...for unauthorized users

Thanks to @jwilsson for support on this (and coffee)