only allow /interaction/url for whitelisted domains