forbid known-bad requests-2.4.2