You are correct, it does work. My mistake was basing my statement on past experiences using an older Firefox ESR version which would give "Content Security Pol

You are correct, it does work. My mistake was basing my statement on past experiences using an older Firefox ESR version which would give "Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)." when clicking on a bookmarklet for sites like Twitter or Github.