Bug 1017228: Any URL on the blocklist should trump allowlisting (r=gcp)