fetch the proper security policy before attempting to load images