[pronoiac]

> Why not store the "is-paying-customer" bit in a cookie?

You shouldn't trust the client. You probably don't want people to get access to paid features with a relatively easy tweak of cookies.

The client-side filter is more suitable for listing, say, malware URLs, as mostly the response is "no" (go ahead) instead of "maybe", which would require a bit more work (like, network requests) to check if it's blocked or not.