Added test for forbidden attribute - admin