I don't know if this has been discussed here before. All the whitelisting discussion I have seen so far was verifying the existance of users.