One last question (sorry!): I just used the "Google" preset configuration to load gmail and it all just worked. I'm still trying to get the hang of interpreting the grid, but at the top left I see in blue ".google.com". Does that mean these whitelistings only apply to pages in a Google subdomain? For example: google analytics requests from some other* domain aren't whitelisted?
Yes, the top-most left-most box is for choosing where the rules apply, I call it the scope selector.
"" = global scope
".example.com" = any web page which sits on 'example.com' or a subdomain of 'example.com'
"example.com" = any web page which sits exactly on 'example.com'
If multiple scopes exist for a given web page, the most narrow one is used. Also, scopes are really sandboxes, there is no inheritance of rules across scopes (trying to implement this is opening a can of worms both on usability and code-wise).
Regarding javascript execution there are two cases:
External javascript: won't execute because the net request for the external resource is blocked.
Inline javascript: won't execute because a Content-Security-Policy directive is injected into the main page or sub frame.
This week I had to write an explanation of how this work because the idea that inline javascript can't be reliably disabled on a Chromium-based browser is still going strong. Here are the details:
https://github.com/gorhill/httpswitchboard/wiki/Blocking-jav...
Regarding the "flash and reload", I noticed that too lately, I have to look into this to understand what is happening.