Flash is not click-to-play
It turns out that Mozilla exempted Flash from click-to-play. We need to also set plugin.state.flash to 1 to actually enforce click-to-play for flash.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information