check forbidden only if there's a black_list_methods in payload