I ended up using the exact same solution! The only annoying thing is that I want "untrusted apps" to open external links in a new DEFAULT tab so that I don't carry over the whitelisted cookies but that requires manual "right click > open in" with the default setup.