ParseUser.fetchInBackground() fails when _User CLP without public get permission

I am using CLP to restrict access to the _User collection, essentially removing all permissions for the public except for create permission. This in my understanding means that anybody can sign up to create an account (POST to /users) but do nothing else unless they are logged in. They can not browse users, or get info about random user by trying to guess objectId and performing random GET /users/abcd for randomly generated abcd.

When the user is logged in (they send a valid X-Parse-Session-Token in the headers) they can GET /users/me to fetch info about their own user account successfully.

The user however can not currently perform GET /users/abc where abc is objectId of a user for which the user successfully obtained a session token via signup or login.

This can easily be demonstrated via iOS or Android SDK where a call to

ParseUser.getCurrentUser().fetchInBackground()

fails with:

error: Permission denied for action get on class _User.

I am sure this may be addressed by setting up proper ACL on the _User collection entries, but I still think the default behavior should be that ParseUser.getCurrentUser().fetchInBackground() should succeed for user for which I have a session token.

Start by reproducing the reported behavior with a _User CLP that allows only public create, then compare GET /users/me and ParseUser.getCurrentUser().fetchInBackground() with a valid session token. Done means an authenticated user can fetch their own account without exposing other users, with coverage for the described permission boundary.