`for entry in whitelist`? I'd expect only domains in `allowdomain`, but it can be almost everything...