CSP for external image sources and HTTPS for gravatar