What do you think about namespacing this into `jekyll_auth.whitelist` in case we have a 2nd setting down the line (and to prevent potential conflicts)?