extend whitelist for uploads