- mega merge
- dropdowns on click
- block inline scripts if current_host not allowed
- only show display-blocked icon in main menu if needed
- button toolbar: don't set 'revoke' class if nothing to undo