CSP error on some pages

[alexanderadam]

Content-Security-Policy: The page's settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: "script-src 'self' 'nonce-ISDABLcpp7JW2w7O3CCgOg=='". Consider using a hash ('sha256-u779H98rexiJj0YWYsoo+2tDMq9IXG1pd/HPCEJ9qzU=') or a nonce.

Load /admin/security (or any admin page that trips this). The response's Content-Security-Policy header carries a fresh script-src 'self' 'nonce-<random>' on every request.
But the HTML body returned alongside that header contains no nonce="..." attribute anywhere.

[stefan-ernst]

Could you try this again in 0.8.7? I was unable to reproduce it here, I wonder if its related to a stale UI issue