Is there a reason they can't implement a whitelist option for this? Something like a list of domain patterns for which lax mode is enabled (and possibly a super

Is there a reason they can't implement a whitelist option for this? Something like a list of domain patterns for which lax mode is enabled (and possibly a superlax mode that would allow CSRF like behavior in some cases)?