Add nonce and post type whitelist