testing hide-if-forbidden