test tag (un)protection via the api