added whitelist to avoid auth