   defp check_access(conn, options) do
     case check_cookie(conn, options) do
       true -> conn
-      false -> handle_unauthorized_access(conn, options)
+      false -> check_whitelisted_paths(conn, options)
     end
   end
 
   defp check_cookie(conn, options) do
     conn = fetch_cookies(conn)
     conn.cookies["auth_key"] == auth_key(options)
+  end
+
+  def check_whitelisted_paths(conn, options) do
+    case Regex.match?(whitelisted_paths(options), conn.request_path) do
+      true -> conn
+      false -> handle_unauthorized_access(conn, options)
+    end
   end
 
   defp handle_unauthorized_access(conn, options) do

    Application.get_env(:gandalf, :auth_key) || opts[:auth_key] || "auth_key"
  end

  defp render_form(conn) do
    conn
    |> put_resp_content_type("text/html")

defmodule Gandalf do
  import IEx
  use Plug.Builder

  def call(conn, options) do
