sanitize key and test to allow some html