whitelist hookshot (no auth needed)