The REST API allows to list wikis and spaces even when the wiki is protected

The REST API allows any anonymous user to list the existing spaces in a wiki, even if the spaces are protected. Shouldn't the API return only the public spaces names in that case? The same goes for the list of private wikis hosted in an XWiki farm.