externalize whitelist of allowed users (for easier changing w/grunt as part of build process)