There are legitimate reasons to whitelist OpenID providers, especially if you are dealing with $$ or want to minimize support costs.