fixed scoping on IDP in the protected API