Thanks Vincent!
But maintaining 2 sitemaps is not very user-friendly.
I found a solution in that post:
Input field for number/free text for openHAB UIs
Changed the field type from “text” to “password”. Save the input as item and put visibility statement in my sitemap.
This is not a real password, but I have to enter a string before the switches are available. Better than no protection at all.