add forbidden page, fix not allowed detection logic