document whitelisting

refs #10