This was previously only enforced by gating the frontend component, this PR
tidies things up by making sure the backend prevent it happening as well