'Check request is permitted to update certain properties.  Read
permission is required to delete a property.
If the property value is unchanged, i.e. a noop, it is permitted,
however, it is important to ensure read access first.  Otherwise the
value could be discovered using brute force.
:param update_props: List of properties to check
:param image_meta: Mapping of proposed new metadata about image
:param orig_meta: Mapping of existing metadata about image
:param req: The WSGI/Webob Request object
:raises HTTPForbidden: if request forbidden to create a property'

def _enforce_update_protected_props(self, update_props, image_meta, orig_meta, req):

    if property_utils.is_property_protection_enabled():
        for key in update_props:
            has_read = self.prop_enforcer.check_property_rules(key, 'read', req.context)
            if (((self.prop_enforcer.check_property_rules(key, 'update', req.context) is False) and (image_meta['properties'][key] != orig_meta['properties'][key])) or (not has_read)):
                msg = (_("Property    '%s'    is    protected") % key)
                LOG.warn(msg)
                raise HTTPForbidden(explanation=msg, request=req, content_type='text/plain')
