"Basic auth confirmation prompt spam / DOS"
It's a relatively basic patch, they add a pref for enabling the prompt and then set the pref a false, by default. They uplifted the patch to beta, so it'll be in release in a few weeks. We could apply it and let is bake in alpha for one cycle, and then release in January. Maybe Mozilla will have a better understanding of the impact by then (see https://bugzilla.mozilla.org/show_bug.cgi?id=1594613).