add whitelist check for package upload, #53