whitelist keys for settings_json