FIX: remove invalid hack, correct whitelist to use value returned from callback
SECURITY: fix XSS in excerpt parser