update development docs for route scope whitelist