Plain field filter check, encoder in form/auth, private -> protected