add a whitelist to auth