load whitelist periodically from WHITELIST_URL