tests for whitelist checking in web API