ensured services not available for end users are never (e.g. in the public and protected API) returned to non client credentials clients