Great! My next step was going to be sending you a pull with a more comprehensive whitelisting solution. :-)

Could you perhaps push the actual instantiation into the class loader as well? That was the symbol values can be vetted by the loader too.