whitelisting html video tag