updated forbidden attributes