allow an optional whitelist for certain apps/referrers