Minor style nitpick, this will read something like "AuthSourceHidden is not permitted" which isn't very informative, perhaps change it to `:auth_source, _("cannot be changed on an internal protected account")` similar to above?