case-insensitive whiteliste check