Its more complicated than just whitelisting zappers, but its open and general. Delegated authentication would be nice in any case, I guess. Unfortunately it adds more work to the ln node too, so

its harder to support as they need to login to each relay.