Restrict allowed hosts for inline images

Otherwise an editor could include an image which could be changed to something
malicious at the whim of the website owner (or an attacker).

I'd appreciate some oversight on whether I've got the list of hostnames correct.