Make refusal of SEC_DESC_DACL_PROTECTED configurable