add "sso" and "velruse" to list of forbidden names

We use these subdomains for velruse single-sign-on login