Actually, extension whitelisting looks fine, I've added a test to verify it: https://github.com/alphagov/whitehall/commit/361e1ffff3b5a1987f7d14b781d32cfbfe260fc9