whitelist, not blacklist!

This fixes an issue where things like local variables
were being interpreted as method names.

Example:

before_filter :blah, filter_options

"filter_options" was being treated as if it were a method name,
which was wrong.