Append data: to the img-src directive automatically

Since <img src=data:....> is safe (besides crazy browser exploits) so let's whitelist that by default.