More robust protocol checking.

Before: hardcoded ':'.
Now: splitting via a PROTOCOL_SEPARATOR constant in whitelist.rb.

//@rafaelfranca