Fix #804: Delay protect() mechanism until desugaring.

The fix is decomposed in two commits. In the first commit the `compiler/` is untouched, so that we can simulate a binary compatibility scenario and verify that the deserialization-time fix works.

The second commit cleans up the compiler not to emit raw `JSApply`s anymore.
Oh, I got it... the deserializer removes all the calls to "protect" (in proper locations...)