security feature improvement (white list, pub-token-url)