fix dumb problems
wrap whitelist in escaped quotes
make server-control template more reusable