Make whitelist dynamically configurable

[venantius]

I think that the whitelist option is going to be something that I want an escape hatch for - i.e. when I think the problem is in application code but it turns out to be in library code and I've painted myself into a corner by setting a whitelist. I guess the implementation is already sort of configurable...maybe what I want is just a function that disables it or something.