add forbidden attributes protection to some specs