allow for whitelist and authenticated-gets to be configured by end user