Router won't return forbidden()

[cringsby]

I am trying to add a router to my paid plans dynamic page (/plans), so that only users that joined with a specific referral code can access a specific plan “ffblissenlaunch”. The plan that I am attempting to gate is at the path plans/f-f-monthly. I am getting the code to properly execute all the way to the return forbidden() in line 15 (I tested using console.log), but It doesn’t actually return forbidden and it allows the user to get through. Code pasted below. Any ideas???