This is by design and is a best practice. That said it can be disabled by the project owner. Documentation on this can be found at http://docs.gitlab.com/ee/user/project/protected_branches.html