Whitelist in a different config key
Support origin whitelisting