If you want your 1999 server to be open for anyone to create a blog there, then you don't need to specify a whitelist. However if you want to limit who can set up a blog, you need a whitelist.
It's an array of Twitter screen names named userWhitelist that you add to your config.json file.
An example of a config.json with a userWhitelist specified.
If you want more flexibility in editing your whitelist, you can put it in a separate file accessible over HTTP. Here's an example of such a file.
Instead of putting the array directly in your config.json file, you would point to it using the urlUserWhitelist value.
The server reads the whitelist file once a minute, so you can change the whitelist without restarting the server. config.json is only read when the server starts up.
Here's an example of a config.json file that specifies a remote whitelist file.