add whitelist notice to readme