allow whitelists, with precedence over blocklists