allow empty whitelist