fix csp to allow data urls for images
Merge branch 'dev/ios' into dev/ios-dummy