changed code to allow users who have XID's but are in the whitelist to have access