only redirect to whitelisted services

Closes #220.