Yeah … long term solution I guess is to add a site setting that allows for the relaxed approval mode I guess, opt in.
I worry though cause getting security right here is very very hard. The more edge cases we allow for, the more complexity and potential security flaws.