action_controller_overview.md: deobfuscate hash whitelisting