Forbid injection on private fields.

Closes #181. Closes #113.