From a recent digging through the codebase it was discovered that some types of requests (e.g. websockets etc.) are not covered by the URL white and blacklist policies. This is not the spirit of those policies and we should do best effort to cover all types of user initiated outbound requests from succeeding to endpoints in the blackslist.