Add docs for `forbidden` params to WSGI.