Pat missed one bit: you need to head to about:config and set "security.tls.version.max" to 4.

Good point. You'd figure I'd remember this after Nick put it on the monster video wall: http://imgur.com/cf28rpt ;)

Think draft 13 is only deployed internally (as we're dogfooding it). Draft 11 is what's live unless you're on VPN. Nick (https://twitter.com/grittygrease) can confirm.

tls13.cloudflare.com now speaks draft 13