I'd suggest Safari could even make cookies require getting user permission, the same way location access needs to be granted. "Allow, allow for 24 hours, deny." It could default deny except for sites to which it has a saved password which could default allow.