It feels to me like the controller should not be responsible for the white list. If we go ahead with this after the test, you should move to its own model file, or move to configuration. If inside conf, it would allow us to have a different whitelist for each environment dev/code/prod e.t.c which would be nice for testing new supported sites.

Just a thought :wink: