Add GET whitelist. Fix #526