add Authenticator.whitelist

default behavior is to allow any user to attempt login
Merge pull request #27 from minrk/auth_whitelist

add Authenticator.whitelist