DO NOT USE THIS INSTANCE FOR LIVE DATA!!!!
At present the config.xml has a hard coded whitelist of '*'' - not overly secure!
This should be parameterised and limited to the a sensible setting