Changed login requirement to explicit whitelisting