don't enable if whitelist and not authorized

This prevents just the cookie alone being enough to trigger profiling,
even if the profiling results cannot be viewed

closes #30
Merge pull request #31 from codekitchen/cookie_whitelist_enforcement

don't enable if whitelist and not authorized