ceph: don't allow access to MDS-private inodes