sanitize mongo ops by whitelist