title: Gitlab protected branch does not protect the branch on ssh push
body: <p>I created a simple project, committed and pushed the master branch, then protected it.  After that I added a user to the project as a developer and this user was allowed to push to master.<br>
  So admin=master, user1=developer.</p>
  
  <p>When I modified and pushed as user1, I was allowed to push to master.  This is odd because I have a production instance that does not allow this.</p>
  
  <p>I used the vagrant installation to setup a development environment.
  After vagrant ssh:<br>
  <code>cd /vagrant/gitlabhq &amp;&amp; git pull --ff origin master</code><br>
   <em>put me at commit a8b544ed770cf172b09feb6ffee14b1814b66ad4, gitlab-shell v1.5.0</em><br>
  <code>cd /vagrant/gitlabhq  &amp;&amp; bundle exec foreman start -p 3000</code><br>
    gitlab was now up and running.</p>
  
  <p>I logged in as admin@local.host<br>
  Added my "admin" key<br>
  Created project "master-protected"<br>
  in a shell, I created the repo, added a file and committed and pushed.</p>
  
  <p>As "user1", I added my key, and in a shell, cloned "master-protected" which user1 has a developer role.</p>
  
  <p>When I modified and pushed master, gitlab accepted the push, and the commit shows right up in gitlab.  It should have denied it.  In fact, when you go to the branches section, and see the master branch as being protected, it's last commit is the commit of the "user1" which only had developer permissions.</p>
  
  <p>Any ideas on where I can look further to try and find out why this is happening in the development environment?  It's the same for tag v5.3.0 as well, and I'm certain it does not happen in production v5.3.0.</p>
  
  <p>it's funny because I was trying to replicate another bug I thought I had found with protected branches not being protected with merge requests and developer roles, but I hit a block with this one.</p>