fix subtle bug in default enforcer