Unplug whitelist

Creating for code review.
Add the caveat here that WebSocket and <audio> / <video> cannot be blocked.