Update Controller.php

badRequest was calling router->forbidden