- removed `network.cookie.thirdparty.sessionOnly` because it can't break sites - added `permissions.default.shortcuts`