fixed /untrust to remove prefixed denial permissions