This fails if auth.whitelist isn't in the DB