implement uri whitelist