Disabling the notification tray in Android L's (5.0) lock screen I think that this is a rather large security issue that has come with the release of Android L. I've always had a password on my lock screen for as long as I can remember, but in Android L it becomes nearly useless.

After locking my device I noticed that I can still pull down the notification tray from my lock screen with which I could toggle Wi-Fi, bluetooth, and data.

If someone was to steal my phone, they could easily turn off any wireless connection even with the phone locked - preventing me from tracking my phone (I realize that they can just turn off the phone and use fastboot to flash a new ROM onto it, but let's assume they're not that smart).

Am I just missing some magically hidden setting to disable the notification tray in the lock screen?
No, you're not missing a setting. This particular decision seems very unfortunate, and a ticket opened with google to resolve this has already some support : Google code ticket.
We can only hope that this will be reverted to the previous behaviour (allowed only when the lockscreen had no pin/password/gesture) or made into a setting.