security feature improvement (white list, pub-token-url)

Add features:
  * whitelist user restriction
  * public token url
  * server value "OWNERID" can be not set