whitelisted image in user params