fixing html whitelist bug