Add a Cucumber spec to test that only admins can access the whitelist