add white list; decode url query