rename whitelist to tags
don't escape characters that are already escaped