* lob: exclude underscores from keyPat to fix false positives * lob: restrict keyPat to lowercase hex * distinguish forbidden responses by their API error code * remove payment_method_unverified from 403 case --------- Co-authored-by: Shahzad Haider <[email protected]> Co-authored-by: Shahzad Haider <[email protected]>