correct whitelist html and github omniauth