wicket upgrade
if link is empty, use guid instead if able (fix #551)
instantiate whitelist only once