Restrict document from enabling icons in SECURE mode

I think we want to restrict the document from turning on icons (which in SECURE mode are really just `<img>` tags with a relative src). Does this sound like sensible restriction?

Icons can be enabled in the server-side application by the application developer.