allow onebox whitelist to be extended