use whitelisting instead of blacklisting for authentication