Which protection is applied on a server response from a protected application?