A safety cap protects hydrogenase from oxygen attack