allow data url and external resources