You think the average user is going to explicitly whitelist? The law requires sites to whitelist their own cookies under penalty of law, instead.
When prompted by the browser on first login/signup, yes, the same way the password manager works. With stored passwords, keeping the login cookie doesn't even add much value.
Well, there is a skip button. It's labelled "accept all"