add whitelist support for auth, add ip rule