No mate, cannot-decode-services is not for ca-profiles section, this is only for cws-connectors!!! See proxyreference!!! Seccond metod. If you want to block some service, you must to check one day to see list of can-decode. When you see what service can decode, you write this:
, all other service will be treated as cannot decode.