Make auth whitelists configurable.