Show/hide field and handle security on backend.

Fixes #470

Use onchange instead of onclick; add default permit in userfields

Avoid resetting $qa_content['script'] when already modified in admin_form()

Fixes #487

No need for this to be part of continuous integration.