fixes for default deny