devtools: fix directory filter in forbidden token check