introduced whitelist and put login:pw default not in settings