Fixed whitelist to deal with multiple url parts