temped to have this be a tiny bit of middleware like `xfoWhiteListijs` invoked as `require("lib/xfoWhiteList")(app)`