whitelist by host base domains, not URLs