URLs whitelist

Allow people to specify an URL whitelist in the login config file.
I'm using this to specify URLs access without authentication, such as public API.