Make whitelist handling more robust

In testing we saw situations where the whitelist could be rendered as
the Ruby class for the attribute, which (obviously) doesn't work.

h/t @jtimberman