Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

["T.V Raman" <raman@google.com>]

The URL package has these two custom settings:

url-cookie-trusted-urls
url-cookie-untrusted-urls

both take a list of regex.

From what I observe, if you set url-cookie-untrusted-urls to '(".*"),
then the setting in url-cookie-trusted-urls e.g. '("example.com") has
no effect. This makes it hard to set up emacs/eww to not trust any
domain, and then progressively allow a few domains to set cookies;
could the  priority order of these settings be reversed?

-- 

--