[whitelist] use WHITELIST_WILDCARD, smart deep override