Use the database for the new URL whitelist

This means that we can validate user input in the transition app without
duplicating the whitelist (or having some other, more elaborate sharing
mechanism).

It will mean an extra query for every redirect Bouncer serves...