Firefox's Privacy Philosophy Explained: No Surprises