One of my top websites is behind HTTP authentication, but the thumbnail only shows the 401 web page that you get when your password is wrong and not the actual web page. It looks like the background thumbnailer does not check the response code.

The background thumbnailer never overwrites existing thumbnails, so it only captures the page if there's not already a thumbnail for it. It'll capture even non-2xx pages under the assumption that non-2xx thumbnails are better than no thumbnails at all. Once you visit the page -- two days later -- the foreground thumbnailer captures a thumbnail showing the page as you see it. That "two days later" part is a staleness check and means that bad background thumbnails aren't overwritten as soon as they could be. We might want to fix that.

Oh, there's expiration, too: Thumbnails expire after a certain amount of time and are deleted. So a nice thumbnail can expire and then a bad background thumbnail might be captured soon after. Bug 809056 made it so only top sites are captured and stored, but it kept the status quo of expiring thumbnails for all pages that aren't open when the expiration filter runs. We should probably make it not expire top sites.