extend xhr login test with forbidden page check

- fix forbidden translation

- fix default user data to contain unicode