add the --verify option

This is the second attempt at #535 - this time targeting the gulp 4 branch. I think I've tackled all the comments left in the original PR (#668) 
blacklist is one word