remove whitelist

"allowed" matches the variable name and is quite clear.