add Authenticator.whitelist

default behavior is to allow any user to attempt login