Changing how the env whitelist works

so that multiple places can add and remove without knowing the full contents of the whitelist.
I wanted uniqueness, either here or where they're written to expvar output.  Making a little set-like thing seemed reasonable, since I don't care about order.