Added restrictions to custom-auth (dvwa and bodgeit)