removes always forbidden attributes (this should be handled by manual config)