fixed typo in html whitelist