Perform tag whitelist check on data ingest too

This is because people may submit with an old client that doesn't
whitelist
I prefer your original intent better, TBH.