server: implement forbidden regex list