make Face constructor and destructor protected