add login support with auth whitelist