script tag whitelisting or code block?