GET /<service_id>/whitelist returns all whitelisted contacts for a service, separated into two lists POST /<service_id>/whitelist removes all existing whitelisted contacts, and replaces them with the provided new entries (todo: dao work + tests)