Fix CSP (* not all, minor refactor)
Disallow images even on link confirm page. Disallow objects everywhere.