view-source requests hit the network
If I visit foo.com and look at its source (e.g. via Ctrl + U) another request is sent over the Tor network using "--NoFirstPartyHost-about-blank--" as SOCKS username. There are two things wrong with that behavior: 1) view-source requests should not hit the network at all as this is not necessary. 2) All these requests are sent over the same circuit allowing user profiling which the isolation to the URL bar domain should prevent.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information