I agree, we should use the shorter list.  It's far better that someone report that they weren't able to complete their valid operation, than for someone to slip something past the security.