removed approved list

removed approved list, client compare username and password before
start()