UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

Steps to reproduce the problem:
1. open a site with CSP 'sandbox'
2. submit the login form
3. it should prompt to save the password

What is the expected behavior?
I would expect it to ask to save the username and password.

What went wrong?
It doesn't ask to save the login. It doesn't put the key icon in the address bar. 

Did this work before? N/A 

Chrome version: Version 64.0.3282.186 (Official Build) (64-bit)  Channel: stable
OS Version: 10.0
Flash Version: 

Simple POC is achieveable with a vanilla plain HTML form, served with Content-Security-Policy: default-src 'self'; img-src 'self' data:; sandbox allow-scripts allow-forms;

Removing the sandbox allows it to work. This works on Firefox 57.