Also add $wgRequest to the forbidden globals...thought it was common sense.