added whitelist ability to default.js