don't enable if whitelist and not authorized

This prevents just the cookie alone being enough to trigger profiling,
even if the profiling results cannot be viewed

closes #30