What does the built-in HTTP daemon do?
The only use of the tiny built-in HTTP daemon is to generate web-based user interfaces which are rendered by Gecko engine (no XPCOM stuff is needed in this manner). This HTTP daemon is derived from another open source project of mine, called MiniWeb. By default it only listens on 127.0.0.1. It never acts as spyware or anything else (I hate spyware to death), and if anyone is suspicious of it, I suggest they inspect the source code.