disable back button, add domain whitelisting