I suspect this generates inline JavaScript. In order to disable inline script via Content Security Policy some time, we need to get rid of all inline JS, so I wouldn't merge this. But there's still a TODO and I assume you would never ask someone to merge code with a TODO, so I'm sure you'll fix this. :dancer: