bookmarklet not allowed to run on some sites

Using org-mode and emacs from recent git, up-to-date org-protocol-capture-html, with firefox nightly & a current Arch Linux.

` emacsclient "org-protocol://capture-html?template=w&url=http:%2F%2Flocalhost%2Findex.html&title=The%20title&body=hello"` produces a capture buffer perfectly (yay!), as does loading this URL in the Firefox address bar:

`org-protocol://capture-html?template=w&url=http:%2F%2Flocalhost%2Findex.html&title=The%20title&body=hello`

However, trying to test out the bookmarklets in a page from github gives the following error in the FF console:

`Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).`

Not sure if this is perhaps actually a bug in firefox (cf [this bug report](https://bugzilla.mozilla.org/show_bug.cgi?id=866522) , but also [this blogpost about the general issue](https://geordgez.github.io/jots/2017/12/31/xss-csp-bookmarklet) ).

it's a bummer but the package still seems to mostly work!