make sure app redir matches secure behavior
imagesrc local, knotes style
imagesrc local, knotes style
style tweaks