ubiquitously whitelisting s.ytimg.com