use protected to indicate that this is not callable directly, but only by
another ctor which will do the initialization. Not sure if coverity will grok
that, but if it doesn't then it can be submitted as a false positive

Change-Id: I8e97c0b441dc407a005913e2b10f0fb48f45672b