add a table whitelist for now; 403 if not in whitelist