blacklist control uses URI model, closes #423