Using an app_setting for the admin whitelist (and interface to set it)