In my case I found that it failed due to

https://www.google.com/recaptcha/

not being added to the "child-src" of the content security policy. From what I gather google loads an iFrame for reCAPTCHA and this needs to be allowed in the browser.