support for defining allowed tags/attributes as string