extended whitelist on orders controller