"show password" button not working due to javascript security policy

[sottolski]

when viewing a password for the first time, it is shown. clicking on "hide password" works as expected. however, afterwards it's not possible to get the password to display again. the javascript console shows as error:

Refused to execute inline event handler because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.