Password required

or you can also install an extension doing it for you:

https://addons.mozilla.org/en-US/thunderbird/addon/9808/

But this functionality is here for some reason. Mozilla products have no suitable way to prevent anybody to manipulate certificates container. They use own certificate container, don't use the one of windows. This was clearly noted as security problem, since the windows own container has a setting to prevent certain manipulations and for example make it somewhat difficult to export and copy private key part of a 509 certificate.
Mozilla products have on the other hand own container and crypto modules thus the keys (certificates) can be used portable, that means they are within the TB files. The password for the security device is intended for at least basic protection of the crypto components. However the whole crypto part is kind of unfinished and has some compatibility problems with some certificates, so if you do not use any private keys (personal certificate) or some specific public keys for some special servers etc, you can use the extension to get rid of the password dialog which has limited function for the moment anyway.