prevent costumes with imported CORS-tainted canvases

expected to fix #155, #154, #151, #148, #147, #127 for future projects