Fix HTML whitelisting