Cleaned up whitelist * Added: /oauth * Added: favicon.ico * Stricten up /login to be either exactly "/login" or under the "/login/" namespace * Used latest google-java-format Change-Id: Ie3614d33d7d8627f4c6eb9d358640380357784a8