added forbidden unit test