allow strings, default donotfollow list
rename to safeReplace