allow adding an item to the whitelist with a block

There are a couple of Classes (not instances) that we need to be able to
deserialize. This allows us to specify just those Classes, without
allowing deserialization of arbitrary classes.