make it a whitelist to support only basestring and list (eg not tuple)