Client can select locked beacon effects
The bug
The following is based on decompiled version of Minecraft 1.9 using MCP 9.24 beta. All method and class names are the names used in the decompiled version.
The client can select beacon effects that are not unlocked. This can be done by for example having the method net.minecraft.client.gui.inventory.GuiBeacon.actionPerformed(GuiButton) send a CPacketCustomPayload with the id of regeneration written as the primary effect.