Everyone could simply bypass that whitelist by using another username to join. What is the point of having a whitelist for offline-mode?