actually, ditch /interaction/url whitelist altogether