Is this going to prevent external images from loading? Do we need a img-src policy of *?