Sanitize: whitelist the elements we approve of