title: Specifying whitelist of domain names still allows others to authenticate with python social auth and django
body: <p>I'm following along this tutorial: <a href="http://www.artandlogic.com/blog/2014/04/tutorial-adding-facebooktwittergoogle-authentication-to-a-django-application/" rel="nofollow">http://www.artandlogic.com/blog/2014/04/tutorial-adding-facebooktwittergoogle-authentication-to-a-django-application/</a> and am specifically interested in the Google authentication. I have successfully been able to create the demo site, and am able to log in using Google. </p>
  
  <p>Reading the documentation of python social auth, you should be able to specify a list of whitelist domains: <a href="http://python-social-auth.readthedocs.org/en/latest/configuration/settings.html#whitelists" rel="nofollow">http://python-social-auth.readthedocs.org/en/latest/configuration/settings.html#whitelists</a></p>
  
  <p>When I place <code>SOCIAL_AUTH_GOOGLE_WHITELISTED_DOMAINS = ['foo.com']</code> in <code>settings.py</code> I am still able to log in using my standard gmail account. How do you limit those who can log in to only those with a <code>@foo.com</code> email?</p>