default allowed users on protected objects now also set via default values