update CSP to allow dataUri images