Moved whitelist check to RequestHandler