Whitelist the data: uri since it's not actually an external resource