Allow whitelist to be accessed before bootstrap has completed, if necessary
Add real CORS tests