The doc at http://docs.oracle.com/javase/8/docs/technotes/guides/javaws/developersguide/syntax.html#resources contains the list of secure VM Arguments and Secure Properties that are allowed in a Java Web Start application or jnlp applet.
The allowed list has been updated several times since it was posted and should be updated in JDK8u docs to reflect the current lists, which can be found in the code in Config.java in deploy/src/common/share/classes/com/sun/deploy/config
Please be aware of that one more JVM flag is going to be added to the list, see JDK-8182674