HTML whitelist now in config.properties