use 404 when not whitelisted