Unplug whitelist

Creating for code review.
Because it's still explicitly a whitelist mechanism, for security -- if two plugins could disagree, then the one which returns 'false' wins.