Add test for req.flick.payload existence.
Add a FIXME comment, reminding me to extract whitelist() into its own NPM package.
Improve the documentation.