Comment 4 for bug 1501428

That’s because the trust store currently whitelists unconfined applications. The prompt you’re getting is from the browser itself, and you’ll get one per domain. The browser should remember your decision, but it doesn’t (that’s a known issue: bug #1425143).
If you test with silo 59 (i.e. browser confined), you will get the system prompt once for webbrowser-app, and it should be added to the trust store’s db.