Allow setting of target_origin, but only if there's a whitelist.