add white_list to AuthFilter