Clarify whitelistUrls