rewrite stats.js to use promises and add regex-whitelisting