Make session whitelist behave like a set