You can check for issues with Total Cookie Protection.

• https://support.mozilla.org/en-US/kb/total-cookie-protection-and-website-breakage-faq
• https://support.mozilla.org/en-US/kb/introducing-total-cookie-protection-standard-mode

Firefox shows a purple shield instead of a gray shield at the left end of the location/address bar in case Enhanced Tracking Protection is blocking content.

• click the shield icon for more detail and possibly disable the protection

You can check the Web Console for relevant-looking messages about blocked content.

• https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
• https://support.mozilla.org/en-US/kb/smartblock-enhanced-tracking-protection
• https://support.mozilla.org/en-US/kb/trackers-and-scripts-firefox-blocks-enhanced-track

You can check for issues with Total Cookie Protection. [...]

Disabling the enhanced tracking protection solved the issue with all websites that shown Content Security Policy error, including glovoapp.com - thank you! I can't edit the question to make it only about Glovo but I'll mark your answer as solution.

In case of Kibana (and several other websites) in regular session Firefox somehow remembers old authentication - it doesn't ask for new credentials and doesn't send Sec-Fetch-User header (which results in Kibana throwing HTTP 405 Method Not Allowed). In private window the header is sent correctly.

That part remains unsolved.

You may have to create a cookie allow exception to workaround cross-site cookie issues.

You can create a cookie allow exception with the proper protocol (https:// or http://) for the current domain via "Tools -> Page Info -> Permissions" or add an allow exception for third-party domains via "Settings".

• Settings -> Privacy & Security -> Cookies and Site Data -> "Manage Exceptions"

It didn't help with Kibana-like issue. Long time ago I identified on several internal websites with a certificate (as in attachment) and checked Remember this decision. Now on half of those websites I have to use a new certificate - I've installed it in Firefox but the browser doesn't ask for the new credential, it just keeps trying to use the old one. I don't think it has anything to do with cookies. That's why the original question is about "sanitizing" given host/domain, as in: remove all settings and set them to defaults because there's apparently more than just cookies.