Index: src/server.js
===================================================================
--- src/server.js	(revision 8afbdd6572a947bce4726d5aa0d0aa0d6c7e5067)
+++ src/server.js	(revision c869272b9b1102a8007325c0133c1a233861e51b)
@@ -66,4 +66,10 @@
       defaultSrc: ["'self'"],
       scriptSrc: ["'self'", "'unsafe-inline'"],
+      // Helmet's default zet script-src-attr op 'none', wat ALLE inline event-
+      // handlers (onchange/onclick/onsubmit) blokkeert — daardoor deed o.a. de
+      // avatar-upload (<input onchange="this.form.submit()">) en de rol-dropdown
+      // niets. We staan inline handlers expliciet toe, consistent met de al
+      // toegestane inline <script> hierboven.
+      scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'"],
       imgSrc: ["'self'", "data:", "https:"],