fix protected override

Because express app.get runs before you get a chance to override
_protected, overriding it in server.js fails.  If however, _protected
itself calls another property of the dashing object, it can be overriden