OK. Had a discussion w/ @josephfung where he let me know that we can supply the whitelisted fields here, when supplying the list of models - and that if you don't supply any fields, then the whole model is whitelisted.
1. This isn't clear from the examples or the comments. Let's add some comments.
2. The majority of the examples should contain field whitelists, since that's the expected use and without examples, I may not understand the syntax needed to implement it.
3. In my ideal world, I'd prefer it if whitelisting the whole model needed to be explicit instead of implicit (like `'Users' => '*'` or something), but I'm willing to let this one go if there are objections.