moved the whitelisted to the client side