Query whitelisting done right.