sanitize-header-list: replace directory removal with
a whitelist regex