disable attribute whitelisting