update timthumb
allow external sites