added note about specificity of whitelist url