add to whitelist script now includes access token