POST of new repository from API is public by default
Creating new repositories on the API is defaulting to public, which is contrary to the API specification. Also, I think this has changed, as it used to work just fine.
The only parameters I set are: name="repository-name" scm="git"
This should default as a private API, and is not. Also, this is using OAuth.