pull whitelist from config, rather than hardcoding