Able to list private datasets via the API

I created a dataset on the demo site and set it to private. When I am not logged in, it still appears in searches, although it does not appear in searches within the system.

http://demo.ckan.org/api/2/util/dataset/autocomplete?incomplete=group