Split up whitelist func, made identity url get safer.