diff --git a/http.go b/http.go
index 4d51fdc..a45f96a 100644
--- a/http.go
+++ b/http.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 )
 
 func init() {
@@ -22,7 +23,7 @@ func httpCommon(res http.ResponseWriter, req *http.Request, fn func(request)) {
 		return
 	}
 
-	user, _, basicAuthOk := req.BasicAuth()
+	users, _, basicAuthOk := req.BasicAuth()
 	if !basicAuthOk {
 		fmt.Printf("basic auth failed\n")
 		res.WriteHeader(http.StatusForbidden)
@@ -42,8 +43,15 @@ func httpCommon(res http.ResponseWriter, req *http.Request, fn func(request)) {
 		return
 	}
 
-	if user != body.FQDN {
-		fmt.Printf("expected %s == %s\n", user, body.FQDN)
+	passed := false
+	for _, user := range strings.Split(users, ",") {
+		if user == body.FQDN {
+			passed = true
+		}
+	}
+
+	if !passed {
+		fmt.Printf("expected %s in %s\n", body.FQDN, users)
 		res.WriteHeader(http.StatusForbidden)
 		return
 	}