Perform tag whitelist check on data ingest too

This is because people may submit with an old client that doesn't
whitelist
You return the data here, but you don't use the return value. The object should've been updated properly anyway, so it works. Was this return intentional?