Description of problem:
When an unprotected repo is set up in rhui-manager and used in a client configuration RPM, yum on the client runs into a problem with the repo. Details are below.

Version-Release number of selected component (if applicable):
RHUI-3.0-RHEL-{6,7}-20160921.n.0

How reproducible:
Always.

Steps to Reproduce:
1. Create two new custom repos: one protected and one unprotected.
2. Create an entitlement certificate with the protected repo.
3. Create a client configuration RPM with both repos (and, optionally, a Red Hat repo.
4. Install the RPM on a client.
5. Run a yum command on the client.

Actual results:
The unprotected repo can't be used because yum gets an HTTP 403 error on the repodata file:

====
[root@cli01 ~]# yum repolist
Loaded plugins: search-disabled-repos
rhui-custom-prot                                       | 2.1 kB     00:00     
rhui-rhel-ha-for-rhel-7-server-rhui-rpms               | 2.0 kB     00:00     
https://cds.example.com/pulp/repos/unprot/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
To address this issue please refer to the below knowledge base article

https://access.redhat.com/solutions/69319

If above article doesn't help to resolve this issue please open a ticket with Red Hat Support.

rhui-custom-prot/primary                               | 1.0 kB     00:00     
rhui-custom-prot                                                          1/1
rhui-rhel-ha-for-rhel-7-server-rhui-rpms/7Server/x86_6 |  53 kB     00:00     
rhui-rhel-ha-for-rhel-7-server-rhui-rpms                              225/225
https://cds.example.com/pulp/repos/unprot/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
repo id                                                 repo name       status
rhui-custom-prot                                        Custom Reposito   1
rhui-rhel-ha-for-rhel-7-server-rhui-rpms/7Server/x86_64 Red Hat Enterpr 225
rhui-unprot                                             unprot            0
repolist: 226
====

Expected results:
The unprotected repo works. (I have one package in it.)

Additional info:
The following lines appear in /var/log/httpd/cds.example.com_access_ssl.log on the CDS:

10.120.47.158 - - [26/Sep/2016:04:06:03 -0400] "GET /pulp/mirror/prot HTTP/1.1" 200 39 "-" "urlgrabber/3.10 yum/3.4.3"
10.120.47.158 - - [26/Sep/2016:04:06:03 -0400] "GET /pulp/mirror//content/dist/rhel/rhui/server/7/7Server/x86_64/highavailability/os HTTP/1.1" 200 101 "-" "urlgrabber/3.10 yum/3.4.3"
10.120.47.158 - - [26/Sep/2016:04:06:03 -0400] "GET /pulp/mirror/unprot HTTP/1.1" 200 41 "-" "urlgrabber/3.10 yum/3.4.3"
10.120.47.158 - - [26/Sep/2016:04:06:03 -0400] "GET /pulp/repos/prot/repodata/3cf255d0673b9e9c483c2553e34674262eac85260fb95135a9d1b0e0e30bc2f2-primary.xml.gz HTTP/1.1" 200 1015 "-" "urlgrabber/3.10 yum/3.4.3"
10.120.47.158 - - [26/Sep/2016:04:06:04 -0400] "GET /pulp/repos/unprot/repodata/repomd.xml HTTP/1.1" 403 239 "-" "urlgrabber/3.10 yum/3.4.3"

And these lines appear in /var/log/httpd/cds.example.com_error_ssl.log:

[Mon Sep 26 04:06:04.350076 2016] [:error] [pid 12894] [client 10.120.47.158:55871] Request denied to destination [/pulp/repos/unprot/repodata/repomd.xml]Client certificate failed extension check for destination: /pulp/repos/unprot/repodata/repomd.xml
[Mon Sep 26 04:06:04.350113 2016] [:error] [pid 12894] [client 10.120.47.158:55871] mod_wsgi (pid=12894): Client denied by server configuration: '/var/lib/pulp/published/yum/https/repos/unprot/repodata/repomd.xml'.