security feature improvement (white list, pub-token-url)
Merge pull request #1 from qnq777/feature-formerging-sec-token1

security feature improvement (white list, pub-token-url, no ownerid)

Add features:
  * whitelist user restriction
  * public token url
  * server value "OWNERID" can be not set