allow usage of HTML5 file api object urls (blob:)

only for ctm loader atm