whitelist html_head attribute