restrict API to those users in whitelist