fix img tag not being whitelisted