As planned elsewhere for the Repository to actually care about the Location hidden flag it needs to be made into a Permission Limitation.

This has dependency on also being able to limit by Siteaccess, which is currently not fully supported by Repository API.