moved whitelist out to a config file