diff --git a/dom/security/nsCSPService.cpp b/dom/security/nsCSPService.cpp
index 7ba531030d..ec32889acf 100644
--- a/dom/security/nsCSPService.cpp
+++ b/dom/security/nsCSPService.cpp
@@ -75,19 +75,23 @@ subjectToCSP(nsIURI* aURI, nsContentPolicyType aContentType) {
   if (NS_SUCCEEDED(rv) && match) {
     return true;
   }
-  // finally we have to whitelist "about:" which does not fall in
-  // any of the two categories underneath but is not subject to CSP.
+
+  // Finally we have to whitelist "about:" which does not fall into
+  // the category underneath and also "javascript:" which is not
+  // subject to CSP content loading rules.
   rv = aURI->SchemeIs("about", &match);
   if (NS_SUCCEEDED(rv) && match) {
     return false;
   }
+  rv = aURI->SchemeIs("javascript", &match);
+  if (NS_SUCCEEDED(rv) && match) {
+    return false;
+  }
 
   // Other protocols are not subject to CSP and can be whitelisted:
   // * URI_IS_LOCAL_RESOURCE
   //   e.g. chrome:, data:, blob:, resource:, moz-icon:
   // * URI_INHERITS_SECURITY_CONTEXT
-  //   e.g. javascript:
-  //
   // Please note that it should be possible for websites to
   // whitelist their own protocol handlers with respect to CSP,
   // hence we use protocol flags to accomplish that.
@@ -278,7 +282,11 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel,
    */
   nsCOMPtr<nsIURI> originalUri;
   rv = oldChannel->GetOriginalURI(getter_AddRefs(originalUri));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(rv)) {
+    autoCallback.DontCallback();
+    oldChannel->Cancel(NS_ERROR_DOM_BAD_URI);
+    return rv;
+  }
 
   bool isPreload = nsContentUtils::IsPreloadType(policyType);
 
@@ -310,6 +318,7 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel,
       // is no point in checking the real policy
       if (NS_CP_REJECTED(aDecision)) {
         autoCallback.DontCallback();
+        oldChannel->Cancel(NS_ERROR_DOM_BAD_URI);
         return NS_BINDING_FAILED;
       }
     }
@@ -333,6 +342,7 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel,
   // if ShouldLoad doesn't accept the load, cancel the request
   if (!NS_CP_ACCEPTED(aDecision)) {
     autoCallback.DontCallback();
+    oldChannel->Cancel(NS_ERROR_DOM_BAD_URI);
     return NS_BINDING_FAILED;
   }
   return NS_OK;
diff --git a/toolkit/content/aboutRights.xhtml b/toolkit/content/aboutRights.xhtml
index cdd94e13cd..20050f374d 100644
--- a/toolkit/content/aboutRights.xhtml
+++ b/toolkit/content/aboutRights.xhtml
@@ -28,13 +28,13 @@
 <p>&rights.intro;</p>
 
 <ul>
-  <li>&rights.intro-point1a;<a href="http://www.mozilla.org/MPL/">&rights.intro-point1b;</a>&rights.intro-point1c;</li>
-<!-- Point 2 discusses Mozilla trademarks, and isn't needed when the build is unbranded.
+  <li>&rights.intro-point1a;<a href="https://www.mozilla.org/MPL/">&rights.intro-point1b;</a>&rights.intro-point1c;</li>
+<!-- Point 2 discusses trademarks, and isn't needed when the build is unbranded.
    - Point 3 discusses privacy policy, unbranded builds get a placeholder (for the vendor to replace)
    - Point 4 discusses web service terms, unbranded builds gets a placeholder (for the vendor to replace) -->
-  <li>&rights.intro-point2-a;<a href="http://www.palemoon.org/branding.shtml">&rights.intro-point2-b;</a>&rights.intro-point2-c;</li>
+  <li>&rights.intro-point2-a;<a href="https://www.palemoon.org/branding.shtml">&rights.intro-point2-b;</a>&rights.intro-point2-c;</li>
   <li>&rights.intro-point2.5;</li>
-  <li>&rights2.intro-point3a;<a href="http://www.palemoon.org/privacy.shtml">&rights2.intro-point3b;</a>&rights.intro-point3c;</li>
+  <li>&rights2.intro-point3a;<a href="https://www.palemoon.org/policies/privacy.shtml">&rights2.intro-point3b;</a>&rights.intro-point3c;</li>
   <li>&rights2.intro-point4a;<a href="about:rights#webservices" onclick="showServices();">&rights.intro-point4b;</a>&rights.intro-point4c;</li>
   <li>&rights.intro-point5;</li>
 </ul>