now have correct token-based whitelisting; may be a fix for #57