whitelist by host base domains, not URLs

(follow-up to #12)