Apply the access restrictions in the front end only (see #5603)