make FORBIDDEN_APPS configurable