add url sanitization whitelist