docs: private boolean isForbidden(String uri) {
          String reqUri = uri.toUpperCase();
          reqUri = removeLeadingSlashes(reqUri);
  
          if (reqUri == null) {
              return false;
          }
  
          // As per spec (servlet 2.4), deny access to WEB-INF
          if (reqUri.startsWith("WEB-INF/") || reqUri.startsWith("META-INF/"))
              return true;
          else if ((reqUri.equals("WEB-INF") || reqUri.equals("META-INF"))) {
              return true;
          } else {
              return false;
          }
      }