use 'main_frame' to find user trigger request.
dynamic whitelist per tab.
Don't whitelist sites visited in redirects only
(That's how you get logged in on youtube)